Enumeration

Local enumeration on Linux is the sweep you run immediately after getting a shell — before chasing privilege escalation paths or moving laterally. The goal is to map what exists: who is on the box, what is running, what the network looks like, and what storage is attached. This gives you the full picture before deciding where to push next.

Start with users and system info. Local user and group enumeration tells you who you are, what groups you are in, and which other accounts exist. Local system enumeration gets you the kernel version, OS release, architecture, installed packages, and environment variables — the kernel version alone feeds directly into privilege escalation decisions.

Then map the network. Network awareness identifies all interfaces, routes, and adjacent hosts. A second interface or an internal route you cannot reach from outside marks this host as a pivot point. Check locally listening services next — ports bound to 127.0.0.1 are invisible from outside and often run without hardening.

Then look at what is running and scheduled. Running processes and service inspection shows what is executing, who owns it, and what paths it references. Cron jobs and scheduled tasks finds root-owned jobs calling writable scripts — one of the most reliable privilege escalation sources on real systems. Check mounted filesystems and storage last to identify unmounted partitions, network mounts, and credentials embedded in fstab.

Once enumeration is complete, move to privilege escalation to act on what you found.