# Enumeration

> Guides for enumerating users, system, network, services, and jobs on Linux

- **URL:** https://hackindex.io/platforms/linux/enumeration
- **Platform:** [Linux](https://hackindex.io/platforms/linux.md)
- **Published:** 2026-03-15
- **Updated:** 2026-03-29

Local enumeration on Linux is the sweep you run immediately after getting a shell ,  before chasing privilege escalation paths or moving laterally. The goal is to map what exists: who is on the box, what is running, what the network looks like, and what storage is attached. This gives you the full picture before deciding where to push next.

**Start with users and system info.** [Local user and group enumeration](https://hackindex.io/platforms/linux/enumeration/local-user-and-group-enumeration) tells you who you are, what groups you are in, and which other accounts exist. [Local system enumeration](https://hackindex.io/platforms/linux/enumeration/local-system-enumeration) gets you the kernel version, OS release, architecture, installed packages, and environment variables ,  the kernel version alone feeds directly into privilege escalation decisions.

**Then map the network.** [Network awareness](https://hackindex.io/platforms/linux/enumeration/network-awareness) identifies all interfaces, routes, and adjacent hosts. A second interface or an internal route you cannot reach from outside marks this host as a pivot point. Check [locally listening services](https://hackindex.io/platforms/linux/enumeration/locally-listening-services) next ,  ports bound to `127.0.0.1` are invisible from outside and often run without hardening.

**Then look at what is running and scheduled.** [Running processes and service inspection](https://hackindex.io/platforms/linux/enumeration/running-processes-and-services) shows what is executing, who owns it, and what paths it references. [Cron jobs and scheduled tasks](https://hackindex.io/platforms/linux/enumeration/cron-jobs-and-scheduled-tasks) finds root-owned jobs calling writable scripts ,  one of the most reliable privilege escalation sources on real systems. Check [mounted filesystems and storage](https://hackindex.io/platforms/linux/enumeration/mounted-filesystems-and-storage) last to identify unmounted partitions, network mounts, and credentials embedded in fstab.

Once enumeration is complete, move to [privilege escalation](https://hackindex.io/platforms/linux/privilege-escalation) to act on what you found.

## Guides

- [Cron Jobs and Scheduled Tasks Enumeration on Linux](https://hackindex.io/platforms/linux/enumeration/cron-jobs-and-scheduled-tasks.md): Enumerate cron jobs, systemd timers, and scheduled tasks on Linux to identify misconfigurations or privileged scripts exploitable for privilege escalation.
- [Linux Local System Enumeration](https://hackindex.io/platforms/linux/enumeration/local-system-enumeration.md): Techniques for enumerating local Linux systems post-access: users, groups, SUID binaries, cron jobs, kernel version, and privilege escalation vectors.
- [Linux Local User and Group Enumeration](https://hackindex.io/platforms/linux/enumeration/local-user-and-group-enumeration.md): Enumerate local Linux users and groups via /etc/passwd, /etc/group, id, whoami, and getent to map privilege levels and identify targets.
- [Locally Listening Services and Internal Ports on Linux](https://hackindex.io/platforms/linux/enumeration/locally-listening-services.md): Identify locally bound services and internal ports on Linux using ss, netstat, and /proc/net to uncover hidden attack surface during post-exploitation enumeration.
- [Mounted Filesystems and Storage Enumeration on Linux](https://hackindex.io/platforms/linux/enumeration/mounted-filesystems-and-storage.md): Enumerate mounted filesystems, storage devices, and disk configurations on Linux to identify sensitive data locations, misconfigurations, and privilege escalation paths.
- [Linux Network Awareness and Interface Enumeration](https://hackindex.io/platforms/linux/enumeration/network-awareness.md): Enumerate Linux network interfaces, routing tables, active connections, and DNS config to map attack surface and identify lateral movement paths.
- [Running Processes and Service Inspection on Linux](https://hackindex.io/platforms/linux/enumeration/running-processes-and-services.md)