Rsync:
Enumeration
List modules, check access, and pull high-value directories
rsync enumeration is module-first. You want a module list, then you immediately test read access on anything that looks like backups, web content, or configs.
Modules that matter in labs: backup, backups, www, web, html, site, etc, conf, home, keys, repo, git, logs.
When you have a readable module, pull it locally and pivot. When modules are locked, you decide whether credentialed access is realistic or you move on.