Initial Manual Enumeration

Start with the basics by hand, just to get a sense of what system you’re on and in what context.


id || (whoami && groups) 2>/dev/null    # Who am I?
grep -vE "nologin|false" /etc/passwd    # Users with console

w               # Currently login users
last | tail     # Login history

File System

pwd         # Where am I now?
ls -al      # What is in the current folder?
ls -al /    # What is in the file system root?

Local File Includes

Proc Files

Under Linux, /proc includes a directory for each running process, including kernel processes, in directories named /proc/PID, where PID is the process number. Each directory contains information about one process, including: /proc/PID/cmdline, the command that originally started the process.


OS & Kernel & Processes

cat /etc/issue
cat /etc/*-release      # What OS release is running?
uname -a                # Kernel details
lsb_release -a          # Backup/alternative option
ps -aux --forest -ww    # Show the process forest

Network Basics

# Host resolution
cat /etc/hosts

# Network interfaces
ip addr show

# Active ports
netstat -punta

Current Environment

echo $PATH

Automated Enumeration

In order of favorites

Linux Smart Enumeration (LSE)

git clone
./ -l1
./ -l2



git clone


Manual Enumeration

Coming Soon (there’s a lot)