SUID enumeration

find / -perm -4000 -type f 2>/dev/null

Enumerates all binaries with the SUID (setuid) bit set on the system. A SUID binary executed by an unprivileged user runs with the owner's UID (typically root): if exploitable, it's a direct privilege escalation vector.

When you need the full list of SUID binaries on the host. It's the first filter after sudo -l: cross-reference the results with GTFOBins (look for the 'suid' tag) and with the list of common SUID binaries to spot anomalies or custom organization binaries.

If the host mounts / with noexec or the filesystem has the nosuid option, the results will be poor. Also avoid it if you already have a clear vector: each full filesystem traversal is noise and time.