sudo -l (sudo abuse)

sudo -l

Lists the commands your user can execute with sudo, with or without a password. It's the first privilege escalation check on any Linux or macOS host: a NOPASSWD rule on an abusable binary (vi, find, less...) is almost free root.

As soon as you have a user shell. I always run it before anything else: if your user has broad sudo permissions or NOPASSWD, the rest of the enumeration is unnecessary. It works the same on macOS (sudoers managed by the system).

If you already know your user is not in sudoers, it will error out and generate a failed attempt log (auth.log). Also don't use it if sudoers is locked down with strict secure_path and the available binaries aren't in GTFOBins: you'd need to look at other vectors.