SSH key harvesting

find / -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" 2>/dev/null

Search the entire system for private SSH keys (id_rsa, id_ed25519) and authorized_keys files: the former allow you to connect to other hosts as their owners, the latter tell you where each key is authorized and where you can plant yours.

When you want to pivot to other hosts in the environment: a private key without a passphrase in /home/admin/.ssh or in a backup gives direct access to servers where that key is authorized. The search is silent (only metadata reads) and almost always finds something: deploy keys, backups with the full .ssh directory, service keys.

If the environment uses only certificate-based authentication or the keys are protected with a passphrase, the find is less juicy (although the passphrase can be attempted offline cracking). Also, don't waste time on hosts where you're already root: there, the way is the SSH agent or the root files directly.