Linux Enumeration Checklist

Phase 1 covers what to do the moment you get a shell. Phase 2 covers what to do once you have root or elevated access.

Identity

Who am I? → System EnumerationWhat groups do I belong to? → System EnumerationWhat can I run as sudo? → User & Group Management

The Machine

What is this machine’s hostname and what role does it play? → System EnumerationWhat OS and kernel version is running? → System EnumerationIs the kernel vulnerable to a known exploit? → System EnumerationWhat CPU architecture is this? → System Enumeration

Other Users

Who else has an account on this machine? → User & Group ManagementWho is currently logged in? → User & Group ManagementAre there any UID 0 accounts besides root? → User & Group Management

Files & Permissions

Are there any SUID or SGID binaries? → Permission AnalysisAre there any world-writable files or directories? → Permission AnalysisAre there any interesting files I can find by name? → Finding Files & DirectoriesAre there any config files containing credentials? → Finding Files & DirectoriesAre there any backup or old files left behind? → Finding Files & Directories

Processes & Services

What processes are running and who owns them? → Process & Service ManagementAre any processes passing credentials as arguments? → Process & Service ManagementWhat services are running? → Process & Service ManagementWhat ports are listening, especially on localhost? → Process & Service ManagementAre there any cron jobs running as root? → Process & Service ManagementAre any cron job scripts writable? → Process & Service Management

Network

What interfaces and IP addresses does this machine have? → Network ConfigurationIs this machine dual-homed — does it bridge two networks? → Network ConfigurationWhat does the routing table look like? → Network ConfigurationWhat other hosts are on the same subnet? → Network ConfigurationWhat established connections are active right now? → Network ConfigurationWhat internal hostnames are in /etc/hosts? → Network Configuration

Security Mechanisms

Is SELinux or AppArmor enabled and in enforcing mode? → Security & HardeningIs a firewall active and what rules are in place? → Security & HardeningIs fail2ban running and what is the ban threshold? → Security & HardeningWhat does the SSH config allow? → Security & Hardening