Bash · from first shebang to incident response

Learn the shell
until nothing surprises you.

A ground-up course for people who run real systems: embedded targets, Linux boxes, networks, and the security work that sits on top of them. Not a command reference — every module teaches what a tool actually does, why it behaves that way, and the specific mistakes that bite people.

22 modules

scratch → mastery

4 exams

milestone gates

1 capstone

host triage collector

0%

your progress

Course completion0%

The sequence

Curriculum

Five blocks. The first four each end in a closed-book exam that gates the next. Blocks I and II make you fluent; III and IV are the specialist tracks — embedded, networking, security; V is where you prove it.

Shell, Shebangs & the First Script

What bash actually is, shebangs, exec vs source, PATH, and the safety header you will type on every script from here on.

Words, Quoting & Expansion

Word splitting, IFS, globbing, "$@" vs $*. The single highest-value module in the course — most shell bugs live here.

Parameter Expansion

Defaults, substrings, pattern removal and replacement, case conversion, indirection. Doing text work without leaving the shell.

Tests & Arithmetic

[[ ]] vs [ ] vs test, (( )), =~ regex, and exit codes as truth values.

Exit Codes, Traps & Error Handling

Why set -e is subtly broken, pipefail, ERR and EXIT traps, and cleanup that actually runs.

Milestone Exam I

Quoting through error handling. Closed-book. Pass to unlock Block II.

Redirection & File Descriptors

exec, custom file descriptors, here-docs and here-strings, /dev/null and /dev/tcp.

Pipelines, Subshells & Process Substitution

<(…) and >(…), why variables vanish inside pipelines, lastpipe, and coprocesses.

Arrays & Associative Arrays

"${a[@]}" quoting, mapfile/readarray, and passing arrays to functions without losing elements.

Text Processing I

grep, sed, cut, sort, uniq, tr — and a real decision framework for which one wins.

Fields, patterns, BEGIN/END, and awk arrays. The tool most people copy-paste and never actually learn.

Structured Data: jq, YAML & CSV

Parsing JSON, YAML and CSV safely — where line-oriented tools stop being correct.

Milestone Exam II

Redirection, pipelines, arrays and text processing. Closed-book.

Processes, Jobs & Signals

The fork/exec model, background jobs, wait, signals, trap, and cleanup that survives a kill.

Concurrency & Parallelism

xargs -P, GNU parallel, flock for mutual exclusion, FIFOs, and the race conditions each one creates.

Filesystem, /proc & /sys

Inodes, permissions, symlinks, find mastery, and reading system state from /proc and /sys.

Writing Real CLI Tools

getopts, usage output, config files, log levels, XDG directories, and exit-code conventions people expect.

Milestone Exam III

Processes, concurrency, the filesystem and tool design. Closed-book.

Portability & Embedded Shell

bash vs POSIX sh vs dash vs BusyBox ash. What breaks on a router, and how to write for a target with no bash at all.

Networking from the Shell

ip and ss (not ifconfig and netstat), curl in depth, socat, nc, dig, and /dev/tcp.

Security: Shell That Cannot Be Exploited

Injection, eval, unquoted-expansion attacks, PATH hijacking, TOCTOU, mktemp, umask, and why setuid scripts are banned.

Security: Offensive & Defensive Tooling

Log triage, auth.log and journald forensics, IOC hunting, integrity checks, and hardening scripts.

systemd, Timers & Automation

Units, timers vs cron, journald, systemd-analyze, and provisioning scripts that are safe to run twice.

Milestone Exam IV

Portability, networking, security and automation. Closed-book.

Testing, Debugging & Quality

bats-core, set -x with PS4, shellcheck in CI, shfmt, and finding the forks that are costing you seconds.

Capstone: Host Triage Collector

A real incident-response tool: gathers system, network and security state, emits JSON, bats-tested, shellcheck-clean, and degrades to BusyBox ash.

Operating manual

How to use this

Type every command yourself. Shell is muscle memory. Keep a terminal open beside the lesson and run each example — including the ones designed to break.
Break things on purpose. Most modules show you a bug before the fix. Run the broken version first and watch it misbehave; that's the part you'll remember at 2am.
Install shellcheck today, not in Module 20. It catches the entire class of quoting bugs Module 01 is about. Every exercise here should pass it clean.
Exams are closed-book. If you can't pass without scrolling back, repeat the block. Shell mistakes in production are unforgiving in exactly this way.
The capstone is the trophy. A tested, shellcheck-clean triage tool that runs on a box with no bash installed is a portfolio piece, not a homework exercise.

Setup

You need a Linux or macOS shell and bash 4.0 or newer — macOS still ships bash 3.2 for licensing reasons, so run brew install bash if you're on a Mac, or the whole arrays-and-associative-arrays block will fail in confusing ways. Module 00 walks through verifying your version and installing shellcheck.