Phase 1 — EnumerationIdentityWho am I? → System EnumerationWhat groups do I belong to? → System EnumerationWhat can I run as sudo? → User & Group ManagementThe MachineWhat is this machine's hostname and what role does it play? → System EnumerationWhat OS and kernel version is running? → System EnumerationIs the kernel vulnerable to a known exploit? → System EnumerationWhat CPU architecture is this? → System EnumerationOther UsersWho else has an account on this machine? → User & Group ManagementWho is currently logged in? → User & Group ManagementAre there any UID 0 accounts besides root? → User & Group ManagementFiles & PermissionsAre there any SUID or SGID binaries? → Permission AnalysisAre there any world-writable files or directories? → Permission AnalysisAre there any interesting files I can find by name? → Finding Files & DirectoriesAre there any config files containing credentials? → Finding Files & DirectoriesAre there any backup or old files left behind? → Finding Files & DirectoriesProcesses & ServicesWhat processes are running and who owns them? → Process & Service ManagementAre any processes passing credentials as arguments? → Process & Service ManagementWhat services are running? → Process & Service ManagementWhat ports are listening, especially on localhost? → Process & Service ManagementAre there any cron jobs running as root? → Process & Service ManagementAre any cron job scripts writable? → Process & Service ManagementNetworkWhat interfaces and IP addresses does this machine have? → Network ConfigurationIs this machine dual-homed — does it bridge two networks? → Network ConfigurationWhat does the routing table look like? → Network ConfigurationWhat other hosts are on the same subnet? → Network ConfigurationWhat established connections are active right now? → Network ConfigurationWhat internal hostnames are in /etc/hosts? → Network ConfigurationSecurity MechanismsIs SELinux or AppArmor enabled and in enforcing mode? → Security & HardeningIs a firewall active and what rules are in place? → Security & HardeningIs fail2ban running and what is the ban threshold? → Security & HardeningWhat does the SSH config allow? → Security & HardeningPhase 2 — PillagingCredentialsCan I read /etc/shadow? → User & Group ManagementAre there any SSH private keys on the system? → Linux PillagingWhat is in every user's command history? → Linux PillagingAre there credentials in any web application config files? → Linux PillagingAre there credentials in any database config files? → Linux PillagingAre there stored cloud credentials (AWS, GCP, Docker)? → Linux PillagingAre there any .netrc, .pgpass, or .my.cnf files? → Linux PillagingAre there any files named with sensitive keywords (password, secret, token)? → Linux PillagingDatabasesCan I connect directly to any running database? → Linux PillagingAre there any SQLite database files on the system? → Linux PillagingLogsDo the auth logs show successful logins and from where? → System LogsDo the auth logs show what sudo commands were run? → System LogsDo any log files contain cleartext credentials? → System LogsDo the web server logs expose credentials in URLs? → System LogsWhat does the cron execution history in syslog show? → System LogsLateral MovementWhat hosts have been SSH'd into from this machine? → Linux PillagingAre there any authorized_keys files that reveal access relationships? → Linux PillagingAre there any other networks reachable from this machine? → Network ConfigurationCan I pivot to a second network using SSH port forwarding or proxychains? → Network Configuration