Enumeration
Find weaknesses.
Enumeration is a free Ethical Hacking Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Enumerate First?
Privilege escalation means turning a low-privilege foothold into root. The first and most important step is enumeration — methodically gathering information about the system to find a path up. "Enumeration is king."
Know Your Context
Start with who and where you are. Identify your user, groups, hostname, and OS version — these shape every subsequent decision.
id
whoami
hostname
uname -a
cat /etc/os-releaseSudo Rights
The fastest win is often sudo -l, which lists what the current user may run as another user. A single misconfigured sudo entry can hand you root instantly.
sudo -lHunting SUID Binaries
Find files with the SUID bit set — they run as their owner (often root). An unexpected SUID binary is a prime escalation candidate.
find / -perm -4000 -type f 2>/dev/nullWritable Files and Directories
World-writable files owned by root, or writable scripts that root executes, are dangerous. Enumerate them to find places you can plant code.
find / -writable -type f 2>/dev/null | grep -v /proc
find / -perm -2 -type d 2>/dev/nullScheduled Tasks
Inspect cron jobs and systemd timers. A root cron job that runs a script you can edit is a classic escalation vector.
cat /etc/crontab
ls -la /etc/cron.d/ /etc/cron.daily/
systemctl list-timersRunning Processes and Services
List processes — especially those running as root — and listening services. A vulnerable service running as root, or one bound to localhost, may be exploitable.
ps aux | grep root
ss -tulnp
netstat -tulnp 2>/dev/nullCredentials and Config Files
Search for passwords in config files, history, and backups. Developers leave secrets everywhere — database configs, .bash_history, and world-readable backups.
grep -rni "password" /etc /var/www 2>/dev/null
cat ~/.bash_history
find / -name "*.bak" 2>/dev/nullKernel and Software Versions
Record the exact kernel and key package versions. An outdated kernel may have a public local-root exploit; an old sudo or pkexec may be vulnerable (e.g. CVE-2021-4034).
uname -r
cat /etc/lsb-release
dpkg -l | grep -i sudoAutomated Enumeration Scripts
Manual checks are essential, but scripts speed things up. LinPEAS, LinEnum, and linux-smart-enumeration automate hundreds of checks and color-highlight likely wins. Review their output critically.
./linpeas.sh | tee linpeas.out
./LinEnum.sh -tStay Organized and Authorized
Keep notes of every finding — escalation often chains several small misconfigurations. And remember: escalate privileges only on systems you are explicitly authorized to test.
Quick Check
Test your enumeration knowledge.
Recap
You learned systematic Linux enumeration:
- Establish context:
id,uname -a, OS version - Check
sudo -l, SUID binaries, writable files - Inspect cron, processes, services, and config secrets
- Note kernel/software versions; use LinPEAS to automate
Next: abusing SUID and sudo.
Frequently asked questions
Is the “Enumeration” lesson free?
Yes — the full text of “Enumeration” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Enumeration”?
Find weaknesses. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Enumeration” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.