Tmux – short for “terminal multiplier” – lets you run and manage multiple terminal sessions from a single windows, without relying on a graphical interface. For most users, that’s a productivity feature. For security professionals, it’s closer to a survival tool and the reason we decided to create the Tmux Cheat Sheet.
During a penetration test, responding to an incident, or conducting a red team operation; losing a terminal session can mean losing hours of work: an active reverse shell, a long-running password cracking job, or a live SSH connection to a jump host. Tmux solves this by decoupling your terminal session from the connection displaying it – you can detach from a session, close your laptop, reconnect from somewhere else entirely, and pick up where you left off.
This cheat sheet covers the full range of tmux commands – installation, sessions, windows, panes, copy mode, and configuration – with a focus on how each one applies to real security work: managing simultaneous SSH connections across an engagement, synchronizing commands across multiple hosts, capturing terminal output for reporting, and keeping a foothold alive on a target without a persistent GUI process to give it away.
Install Tmux
Tmux ships pre-installed on most security-focused distributions, including the popular Kali Linux and ParrotOS. If you’re working from a general-purpose Linux or macOS system, install it using one of the following:
| Command | Description |
|---|---|
sudo apt-get update && sudo apt-get install tmux |
Intall on Debian/Ubuntu/Kali |
sudo dnf -y install tmux |
Install on Fedora |
sudo yum -y install tmux |
Install on CentOS |
brew install tmux |
Install on macOS |
tmux -V |
Check installed version |
Tip: Confirm your version before an engagement – older tmux builds (pre v3.0) lack some pane synchronization and formatting features referenced later in this guide.
Tmux Terminology
| Term | Description | Security Relevance |
|---|---|---|
| Pane | A single pseudo-terminal, which may fill the whole window or sit alongside others | Dedicated one pane per tool – nmap output in one, a listener in the other |
| Window | A persistent collection of windows managed by tmux; survives disconnects | Your working context for an engagement – survives a dropped SSH link, VPN blip, or laptop lid close |
| Client | The process displaying a session to you | Any terminal attached to a session – including one on a different machine reattaching later |
| Server | Manages all sessions; communicates with clients via a socket in /tmp |
On shared or multi-user boxes, sessions can be scoped to a custom socket (-S) to keep them separate or less visible |
Tmux Cheat Sheet: Quick Shortcuts Reference
Run from the CLI (outside of Tmux):
| Command | Description |
|---|---|
tmux |
Launch tmux |
tmux -V |
Check tmux version |
tmux ls |
Show all sessions |
tmux info |
Show every session, window, and pane |
tmux a |
(Re)attach to the most recently created session |
tmux list-keys | less |
List all keybindings |
man tmux |
Full manual |
Run inside a tmux session (prefix key is Ctrl+b by default):
| Command | Description |
|---|---|
Ctrl+b ? then q |
List all commands, then close the list |
Ctrl+b : |
Enter command mode |
Ctrl+b l (lowercase l) |
Clear console contents |
Ctrl+b t |
Show computer time |
Ctrl+b c |
Create new window |
Ctrl+b , |
Rename current window |
Ctrl+b p / Ctrl+b n |
Previous/next window |
Ctrl+b w |
List windows |
Ctrl+b % |
Split pane vertically |
Ctrl+b " |
Split pane horizontally |
Ctrl+b (arrow keys) |
Move between panes |
Ctrl+b d |
Detach from session |
Session Management
Create a session
| Command | Description |
|---|---|
tmux / tmux new / tmux new-session |
Create a new session |
Ctrl+b :new |
Create a new session from inside tmux |
tmux new -s recon |
Create a named session (e.g., recon) |
Ctrl+b :new recon |
Create a new named session from inside tmux |
Naming convention for engagements: Name sessions per client or per target rather than leaving them as numbered defaults – e.g., tmux new -s hackingloops-extnet or tmux new -s ir-case-0042. On a share or long-running box, this avoids confusion between engagements and makes cleanup at close-out far less error-prone.
List Sessions
| Command | Description |
|---|---|
tmux ls / tmux list=sessions |
Show all sessions |
Ctrl+b s |
Show all sessions from inside tmux |
Attach, Detach, and Navigate Sessions
| Command | Description |
|---|---|
tmux a / tmux at / tmux attach |
Attach to the most recently created session |
tmux a -t hackingloops-extnet |
Attach a specific named session |
Ctrl+b $ |
Rename current session |
Ctrl+b d |
Detach from session |
Ctrl+b w |
Session and window preview |
Ctrl+b ( / Ctrl+b ) |
Move to previous/next session |
Kill Sessions
| Command | Description |
|---|---|
tmux kill-ses / tmux kill-session |
Kill the last active session |
tmux kill-ses -t hackingloops-extnet |
Kill a specific named session |
tmux kill-ses -a |
Kill all sessions except the current one |
tmux kill-ses -a -t hackingloops-extnet |
Kill all sessions except the one named |
OPSEC note: At the close of an engagement – especially on a jump host, shared team box, or any system that isn’t yours long term – kill all your sessions explicitly rather than just closing the terminal. A detached session (and its socket) will otherwise persist indefinitely, potentially exposing tool output, credentials in scrollback, or the fact you were there at all.
Isolated Sockets (custom -S)
| Command | Description |
|---|---|
tmux -S /tmp/.eng01 new -s recon |
Start a session on a custom socket path |
tmux -S /tmp/.eng01 a |
Attach using that same custom socket |
Using a non-default socket path keeps your sessions separate from other users’ tmux sessions on a shared system, and from the default tmux ls output of anyone else on the box.
Window Management
| Command | Description |
|---|---|
tmux new -s recon -n nmap |
Create a new session and name the first window |
Ctrl+b c |
Create new window |
Ctrl+b , |
Rename active window |
Ctrl+b & |
Close active window (confirms with y/n) |
Ctrl+b p / Ctrl+b n |
Previous / next window |
Ctrl+b w |
List windows (select/expand with arrow keys) |
Ctrl+b :swapw -s 0 -t 2 |
Swap windows 0 and 2 |
Ctrl+b :swapw -t -1 |
Move active windows left by one position |
Tool-per-window convention: Name each window after what’s running in it – nmap, burp, msf, notes, loot – rather than leaving default numeric labels. This makes a session self-documenting at a glance, which matters both for your own workflow across a multi-day engagement and if a teammate ever needs to pick up where you left off.
Pane Management
| Command | Description |
|---|---|
Ctrl+b q |
Show pane numbers briefly |
Ctrl+b q then 0-9 |
Switch to pane by number |
Ctrl+b o |
Go to next pane |
Ctrl+b z |
Zoom in/out of the current pane |
Ctrl+b ! |
Convert current pane into a new window |
Ctrl+b % |
Split vertically |
Ctrl+b " |
Split horizontally |
Ctrl+b (arrow keys) |
Switch to adjacent pane |
Ctrl+b ; |
Toggle last active pane |
Ctrl+b [spacebar] |
Toggle between pane layouts |
Ctrl+b { / Ctrl+b } |
Move current pane left/right |
Ctrl+b x |
Close current pane |
Ctrl+b :resize-pane -L 5 |
Resize pane boundary (flags: -U / -D / -L / -R |
Synchronize Panes
| Command | Description |
|---|---|
Ctrl+b :setw synchronize-panes on |
Send every keystroke on all panes in the window simultaneously |
Ctrl+b :setw syncrhonize-panes off |
Turn synchronization back off |
This is one of the most useful tmux features for security work – see the dedicated section below for a full walkthrough.
Split Layouts (Meta Key)
Press Alt (Linux) or Esc (macOS) followed by a number:
| Combo | Layout |
|---|---|
Meta 1 |
Uniform vertical split |
Meta 2 |
Uniform horizontal split |
Meta 3 |
Horizontal split, main pane on top |
Meta 4 |
Vertical split, main pane on left |
Meta 5 |
Tiled, new panes bottom-then-right |
Copy Mode & Buffers
Tmux’s buffer is its internal clipboard. Buffers are numbered (buffer_0, buffer_1, …) in the order they’re created.
| Command | Description |
|---|---|
Ctrl+b :setw -g mode-keys vi |
Use vi-style keys in copy mode |
Ctrl+b [ |
Enter copy mode |
↑ / ↓ |
Scroll up/down |
q |
Quit copy mode |
0 / $ |
Beginning / end of line |
g / G |
First/last line |
h / j / k / l |
Move left/down/up/right |
b / e / w |
Word backward / word-end forward / word forward |
/ / ? |
Search forward/backward |
n / N |
Next/previous search |
[spacebar] |
Begin selection |
[Enter] |
Copy selection |
Esc |
Clear selection |
Ctrl+b |
Paste selection |
Ctrl+b :show-buffer |
Display buffer_0 contents |
Ctrl+b :capture-pane |
Copy the pane’s visible contents to a buffer |
Ctrl+b : list-buffers |
Show all buffers |
Ctrl+b :choose-buffer |
Show all buffers and paste to a chosen one |
Ctrl+b :save-buffer findings.txt |
Save buffer contents to a file |
Ctrl+b :delete-buffer -b 1 |
Delete buffer_1 |
Engagement logging tip: capture-pane combined with save-buffer is a fast, dependency-free way to snapshot terminal output for a report – e.g., capturing an nmap scan’s final output or a successful exploitation sequence straight to a text file without needing script or a separate logging tool.
Tmux Configuration
Tmux is configured via ~/.tmux.conf. Create it if it doesn’t exist:
touch ~/.tmux.confReload after editing:
tmux source-file ~/.tmux.confTmux Keybindings
| Config Line | Effect |
|---|---|
unbind '"' bind - split-window -v |
Rebind horizontal split from ” to – |
unbind % bind | split-window -h |
Rebind vertical splits from % to | |
unbind C-b set -g prefix C-a |
Change prefix key from Ctrl+b to Ctrl+a |
Why this matters for security work: Some CLI tools and TUI-based utilities (certain vim configurations, some CTF/exploit-dev tooling) use Ctrl+b for their own bindings. Remapping the tmux prefix to something less commonly claimed – Ctrl+a is a popular choice – avoid keybinding collisions when you’re running tmux inside tmux, or alongside heavily customized shells.
Default to vi Keys in Copy Mode
setw -g mode-keys viStatus Bar Customization
| Config Line | Effect |
|---|---|
set -g status-justify [left/centre/right] |
Align window names in the status bar |
set -g status-left '...' |
Replace the session name shown in the status bar |
setw -g window-status-format '#[fg=white,bg=black]#I' |
Custom window name formatting |
Useful variables: #I (window index), #S (session name), #W (window name). Full formatting reference: man tmux, then search for the STYLES section.
To reset to defaults: clear ~/.tmux.conf and run tmux kill-server, then restart your terminal.
Using Tmux with SSH
A common security workflow is managing several simultaneous SSH connections – to different hosts in scope, jump boxes, or compromised systems – without any one of them monopolizing your terminal.
Basic pattern:
- Start a new tmux session with one window per target:
tmux new -s engagement -n host1 - In each window, open an SSH connection:
ssh user@10.10.10.11 - Create additional windows (
Ctrl+b c) for additional hosts, renaming each (Ctrl+b ,) to match the target - Detach (
Ctrl+b d) when you need your terminal back – every SSH connection stays alive in the background - Reattach later (
tmux a -t engagement) to resume exactly where you left off.
This means a dropped VPN connection, a closed laptop lid, or a network hiccup doesn’t kill your SSH sessions – only your view of them is interrupted, not the session themselves.
Synchronize-Panes Across Hosts
synchronize-panes sends every keystroke you type to every pane in the current window at once. Applied to a window where each pane holds an SSH session to a different host, this becomes a lightweight way to run the same command across many systems simultaneously.
Example workflow:
- Open a window and split it into multiple panes (
Ctrl+b %/Ctrl+b ") - SSH into a different host from each pane
- Enable sync:
Ctrl+b :setw synchronize-panes on - Type a command once – it executes on every connected host at the same time
- Disable sync (
Ctrl+b :setw synchronize-panes off) before doing anything host-specific, to avoid accidentally running a targeted command everywhere.
Where this is useful in practice:
- Running the same recon or enumeration command across a batch of in-scope hosts
- Checking patch levels or configuration settings across a fleet during an assessment
- Applying identical remediation or verification commands across multiple systems during incident response
Caution: Because every keystroke goes to every pane, this is also an easy way to run a destructive or host-specific command somewhere you didn’t intend to. Always double-check which panes are active before typing, and turn sync off as soon as you’re done with the batch operation.
Detach & Reattach: Surviving Dropped Connections
This is the core reason Tmux earns a permanent place in a security professional’s toolkit.
The Mechanic
| Command | Description |
|---|---|
Ctrl+b d |
Detach from current session |
tmux ls |
Confirm the session is still running |
tmux a -t [session] |
Reattach to it |
Why This Matters Operationally
Long-running jobs survive disconnection. A password-cracking job (hashcat, hydra), a long nmap scan, or a data exfiltration transfer keeps running inside the tmux session even in your local terminal, SSH client, or network connection drops.
Reverse shells and footholds persist. If you’ve caught a reverse shell inside a tmux window on your attack box, losing your local terminal doesn’t lose the shell – reattach and it’s still there.
You can reattach from a different machine. Because tmux sessions live on the server the tmux process is running on (not on your local client), you can detach from your desktop and reattach from a laptop elsewhere, as long as both can reach the same session – useful for handing off or resuming an engagement from a different location.
Unexpected disconnects don’t cost you the session. A closed laptop lid, a Wi-Fi drop, or an SSH timeout kills the connection, not the session. Reattaching picks up exactly where you left off, scrollback and all.
Security Tradecraft & OPSEC Notes
A few additional practices worth knowing, specific to how tmux gets used in offensive and defensive security work:
- Persistent shells on a target. Running tmux on a system you’ve gained access to – inside an existing shell – lets you detach and reattach to that shell later without re-establishing access, similar to how it’s used on your own attack box. This is well-known tradecraft on both red and blue teams; defenders should be aware that an unexpected tmux/screen process or socket file under
/tmpcan be an indicator of persistence. - Continuous pane logging (pipe-pane).
Ctrl+b :pipe-pane -o 'cat >> ~/session.logpipes all output to a log file in real time, useful for maintaining an audit trail during an engagement or investigation without manually capturing panes. - Custom sockets for isolation. As noted earlier,
tmux -S /path/to/socketkeeps a session off the defaulttmux lslisting for other users on a shared system. - Clean up after yourself. Kill sessions (
tmux kill-ses) and remove custom socket files at the end of an engagement, especially on any system that isn’t exclusively yours. Leftover sessions can expose command history, tool output, or credentials to anyone else with access to that box.
Tmux Cheat Sheet Frequently Asked Questions
What is tmux?
Tmux (“terminal multiplexer”) lets you run and manage multiple terminal sessions from one window, and – critically for security work – keeps those sessions running even after you disconnect from them.
How do I enter commands in tmux?
Either directly from the CLI prefixed with tmux, or inside a session using the prefix key Ctrl+b for short commands, or Ctrl+b : for longer named commands.
How do I create tmux sessions?
tmux new -s <name> – see Session Management
How do I list all tmux sessions?
tmux ls – see Session Management
How do I switch between windows in tmux?
Ctrl+b n (next) or Ctrl+b p (previous) inside a session – see Window Management
How do I use tmux with SSH?
Open a tmux session, dedicate a window to each SSH connection, detach when you need your terminal back – the connections stay alive. See Using Tmux with SSH
Why is tmux especially useful in security work?
It lets you run parallel operations – multiple SSH sessions, long-running scans or cracking jobs, reverse shells – without losing any of them to a dropped connection, closed laptop, or network interruption. It also supports running identical commands across multiple hosts at once via pane synchronization.
How do I recover a session after a dropped connection?
Run tmux ls to confirm the session is still alive, then tmux a -t <session> to reattach. See Detach & Reattach