System Enumeration

id && whoami

sudo -l                             # Critical · check immediately

uname -a                            # Kernel version → CVE search

cat /etc/os-release                 # Distro info

cat /etc/passwd                     # Users with shells

netstat -tlnp 2>/dev/null || ss -tlnp  # Internal services

ps aux                              # Running processes

ls -la /home/                       # Other users' home dirs

env                                 # Environment variables · may contain creds

cat /etc/crontab                    # Scheduled jobs

grep -v 'nologin\|false' /etc/passwd

cat /etc/shadow 2>/dev/null

unshadow /etc/passwd /etc/shadow > combined.txt

john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt

find / -perm -4000 -type f 2>/dev/null | sort

find / -perm -u=s -type f 2>/dev/null | sort

find / -writable -type f 2>/dev/null | grep -v proc

find / -writable -type d 2>/dev/null | grep -v proc

find / -mtime -5 -type f 2>/dev/null | grep -v proc | grep -v sys

ls -la /etc/ | grep -v root

ss -tlnp

netstat -tlnp 2>/dev/null

cat /etc/services

df -h

cat /etc/fstab

mount | grep -v "proc\|sys\|dev\|run\|tmpfs"