Enumeration Checklist

id
whoami
groups

uname -a
cat /etc/os-release
cat /proc/version
hostnamectl
arch

cat /etc/passwd
cat /etc/passwd | grep -v nologin | grep -v false
cat /etc/group
last
w

grep -E '/bin/(bash|sh|zsh)' /etc/passwd

ip a
ip route
ss -tlnp
netstat -tlnp
cat /etc/resolv.conf
cat /etc/hosts
arp -a

ps aux
ps aux | grep root

# Download pspy
https://github.com/DominicBreuker/pspy/releases

./pspy64

crontab -l
ls -la /etc/cron*
cat /etc/crontab
systemctl list-timers

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

getcap -r / 2>/dev/null

sudo -l
sudo -V

find / -writable -type d 2>/dev/null
find / -writable -type f 2>/dev/null | grep -v proc

find / -writable -user root -type f 2>/dev/null | grep -v proc

dpkg -l
rpm -qa
apt list --installed 2>/dev/null

df -h
mount
cat /etc/fstab
lsblk

find / -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" 2>/dev/null
ls -la /home/*/.ssh/
ls -la /root/.ssh/ 2>/dev/null

find / -name "*.conf" -o -name "*.config" -o -name "*.bak" -o -name "*.old" -o -name "*.txt" 2>/dev/null | grep -v proc | grep -v sys

cat ~/.bash_history
cat ~/.zsh_history
find / -name "*history" -type f 2>/dev/null

grep -ri "password" /etc/ 2>/dev/null
grep -ri "pass" /var/www/ 2>/dev/null
grep -ri "DB_PASSWORD" / 2>/dev/null | grep -v proc

uname -r
cat /proc/version

id | grep -i docker
id | grep -i lxd
ls -la /var/run/docker.sock