Post-foothold enumeration & credential hunting

When it applies

You have a shell as a low-privileged user and need to know what you're standing on and where to go next. This is the situational-awareness pass that precedes escalation: it surfaces the leads that privesc-arsenal (local privesc vectors) and ad-pivot-arsenal (domain) then exploit. On Windows run whoami /priv and on Linux sudo -l first — an enabled privilege or sudo rule is a shortcut past all of this.

Why it works

Machines leak their own secrets: config files hold DB and service passwords, history files record typed credentials, home directories and shares carry keys, and the OS records who runs what. A methodical sweep — then a targeted grep for secrets — finds the reused password or private key that turns one foothold into root/SYSTEM or the next host. Enumerate before you exploit; noise and dead ends come from skipping this.

Method

Work top-down; note every lead in notes.md and follow the strongest one.