Host Recon

For automated enumeration of potential PE vectors see here.

Help

# List available commands
compgen -c | sort | less
compgen -a | sort | less

# Help for a specified command
man <command>
<command> --help

Networking

Network Info

General networking information, such as interfaces, IP addresses, and DNS:

ip addr show
ip a
ifconfig -a # deprecated

# Show interfaces
ip link show

ARP Table

Active Connections

Routes

System

pspy can be used on the target to enumerate real-time system information!

General Info

# General system information
neofetch
hostnamectl
uname -a

# Name of the host
hostname

# Kernel version & distro info
uname -r
cat /etc/os-release

# Terminal history file
cat ~/.bash_history
cat ~/.zsh_history
history

# Environment variables
printenv
env

# Named pipes
ls -l /proc/sys/fs/pipe-max-size
lsof

# sudo version
sudo --version

Packages

Processes

Services

Users & Groups

Users

# Current user
whoami

# List current user's privileges
sudo -l

# List current user's information
id
getent passwd $(whoami)

# List local users
cut -d: -f1 /etc/passwd
getent passwd

# List active (logged-on) users (works only on Windows Servers)
who

# Elevated permissions
sudo -l

Groups

Files

General

# List all (including) hidden files
ls -la

# Include subdirectories
ls -laR

# Search for a specific file
locate local.txt
find / -type f -name "local.txt" 2>/dev/null

# Exclude a single directory
find / -path /proc -prune -o -writable -print 2>/dev/null

# Exclude multiple directories
find / \( -path /proc -o -path /var/www \) -prune -o -writable -print 2>/dev/null

# Case-insensitive search
find / -type f -iname "local.txt" 2>/dev/null

# Recursive scan 
grep -riH "password" /path/to/directory

SUIDs

Capabilities

Shadow

Passwd

SSH Keys

Scheduled Jobs

# Print jobs
crontab -l
cat /etc/crontab
cat /var/log/syslog | grep "CRON"