Information Gathering

The phase of collecting information is an important part in our process. We are especially looking for information concerning the configuration of the system, so we can take advantage of potential shortcomings. For example, a cronjob may have been created in a Linux system where root executes script X every hour. If, however, all system users are allowed to write to this script, we can easily gain root privileges. A simple way would be to include our current user in the sudoers group.

The misconfiguration in the above scenario - and thus our prized conquest - could only be identified by us by gathering information about users (root), files (script X) and services (cronjob). Therefore, as soon as we gain access to a system, we should at least look for the information listed below. We should also mention here that the basic purpose of the following Linux commands can be transferred to other operating systems.

Information about users

  • id
  • sudo -l
  • cat /etc/passwd
  • cat /etc/shadow
  • cat /etc/group
  • cat /etc/sudoers

Information about files and services

  • cat /etc/crontab
  • cat /etc/cron/
  • find / -uid 0 -perm -u=s -type f 2>/dev/null
  • grep -ir pass /*
  • ls -ahlR /root/
  • ls -ahlR /home/
  • ps aux

Information about the network

  • ip addr show
  • hostname
  • ss -antp
  • iptables -L
  • cat /etc/resolv.conf

Information about the kernel

  • lsb_release -a
  • uname -a

binsec academy GmbH – Advanced Pentest Training Lab

binsec academy GmbH operates the Pentest Training Lab, a highly practical online platform dedicated to real penetration testing. Simulating complex corporate networks and advanced real-world attack scenarios within isolated lab environments, it is engineered to sharpen the skills of aspiring and professional penetration testers. Upon conquering our rigorous, fully practical examination, participants earn the distinguished Binsec Academy Certified Pentest Professional (BACPP) designation — proving their technical capability to methodically uncover and evaluate vulnerabilities in modern IT infrastructures.

Explore the Pentest Training Lab

binsec GmbH – Experts in Penetration Testing

As the operative pentesting core of the binsec group, binsec GmbH has provided high-end, human-led penetration testing since 2013. Rejecting automated scans, our permanently employed, certified senior pentest experts deliver manual deep-dive assessments of web applications, APIs, mobile apps, complex network infrastructures, cloud environments, and advanced red team simulations. Specializing in high-regulation sectors like Payment, Banking, and Healthcare, we provide clear risk evaluations and actionable reports to effectively assess your business-critical systems.

Get Manual Expert Penetration Testing Services

Contact

binsec GmbH
Clemensstraße 6-8
60487 Frankfurt am Main
Germany

Legal notice

Director: Patrick Sauer
Authorized Officer: Dominik Sauer, Florian Zavatzki
Registration: Frankfurt am Main, HRB97277
Turnover Tax Identification No.: DE290966808