Linux Discovery After Initial Access

Introduction

Linux Discovery is the systematic process of examining a Linux system after access has been obtained to understand the host, its users, privileges, processes, services, network configuration, filesystems, software, scheduled activities, and security controls.

In ethical hacking, understanding Linux Discovery helps security professionals reproduce the perspective of an attacker who has already obtained access to a Linux system. The objective is to understand what information becomes available from the accessed account, how that information can reveal the system’s security posture, and how visibility can change when privileges are increased.

In a real-time attack, Linux Discovery is used to build an understanding of the compromised Linux system and determine what opportunities exist from the attacker’s current position. An attacker may identify the operating system, users and groups, available privileges, running processes, services, network connections, accessible files, installed software, scheduled tasks, and security controls. This information helps the attacker understand the role of the compromised system, identify systems and resources that may be reachable from it, and determine what actions may be possible with the privileges currently available.

Discovery may also continue as the attack progresses. If additional privileges are obtained, the system can be examined again to determine what information or resources have become accessible. Linux Discovery is therefore primarily about understanding the compromised environment and the access available within it, rather than simply collecting system information.

Discovery Phase in the Cyber Attack Lifecycle

The Cyber Attack Lifecycle describes the different stages through which a cyber attack can progress, from understanding the target and gaining access to carrying out actions that may ultimately achieve the attacker’s intended impact.

The Cyber Attack Lifecycle includes:

• Reconnaissance
• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Command and Control (C2)
• Exfiltration
• Impact

Discovery is the phase in which an attacker seeks to understand the environment after obtaining access. On a Linux system, this involves examining the host, its accounts, privileges, processes, services, network configuration, filesystems, software, scheduled activities, and security controls.

In an actual attack, these activities do not necessarily follow a rigid sequence. An attacker may begin examining a system soon after obtaining Initial Access and may continue Discovery as additional privileges, credentials, or access become available.

What Happens During Discovery?

Once access to a Linux system has been established, an attacker may need to determine:

• Who am I?
• What privileges do I have?
• What operating system is running?
• Which users and groups exist?
• What processes are running?
• Which services are active?
• What network interfaces and connections exist?
• What files and directories are accessible?
• What software is installed?
• What scheduled tasks are configured?
• Which security controls are enabled?

The answers provide a progressively clearer picture of the accessed system.

Discovery and Privilege Level

Discovery is strongly influenced by the privileges of the account performing it.

A standard account may be able to obtain substantial information about the host while being unable to access protected files or certain system information.

If the account subsequently obtains elevated privileges, Discovery can be performed again with greater visibility.

Discovery therefore provides information that can help an attacker understand the system before and after changes in privilege.

Discovery Access After Initial Access

After Initial Access has been established, the attacker needs some form of access through which the Linux system can be examined. The type of access obtained determines how commands can be executed and which privileges are initially available.

Initial Access does not necessarily provide an interactive Bash shell. Depending on the attack scenario, an attacker may obtain authenticated access, application-level execution, service-account execution, restricted command execution, container access, or an interactive shell.

The following are common Initial Access scenarios that may provide an attacker with access to a Linux system. Once access is established, the attacker can begin Linux Discovery based on the privileges and type of access obtained. In an ethical-hacking assessment, these scenarios can be examined without reproducing the exploitation process itself.

Compromised SSH Credentials

If valid SSH credentials have been compromised, authentication to the Linux server may provide an interactive shell under the privileges assigned to that account.

The resulting session could provide a standard user shell such as:

alice@server:~$

The shell operates with the permissions assigned to the account.

Vulnerable Web Applications

A vulnerable web application may provide command execution through the web server or application process. The commands execute with the privileges assigned to that process.

For example, a web application running under the www-data account may execute commands with that account’s privileges:

www-data@server:~$ whoami
www-data

The scope of Discovery is therefore limited to the permissions available to the web application process.

Command Injection

A command-injection vulnerability can cause an application to execute operating-system commands using the application’s existing privileges.

The resulting execution context may therefore be a service account rather than an interactive user.

Remote Code Execution

Remote code execution can provide the ability to execute code on the Linux host through a vulnerable application or service.

The resulting privileges depend on the account under which the vulnerable component operates.

Compromised Administrative Credentials

Compromised administrative credentials may provide substantially greater access.

In such a situation, Discovery may begin from an already privileged context rather than from a standard account.

Exposed Management Interfaces

Management platforms and administrative interfaces can sometimes provide operating-system command execution or other privileged functionality when their access controls are compromised.

Compromised Application and Service Accounts

An application or service may operate under a dedicated account created specifically for that service. If that account is compromised, it may provide access to the Linux system without providing administrative privileges.

For example, a database service may operate under a dedicated account:

postgres@server:~$ whoami
postgres

The scope of Discovery is determined by the permissions assigned to that application or service account.

Container and Application Compromise

If an application running inside a container is compromised, the resulting shell may initially exist inside the container rather than directly on the underlying Linux host.

Discovery must therefore establish what environment has actually been accessed.

Compromised Software and Packages

Compromised or vulnerable software can result in code execution under the identity of the affected process.

The resulting Discovery capability depends on that process’s privileges and the security controls protecting the system.

Reverse Shells

A reverse shell is a mechanism through which command execution can result in an interactive shell on the accessed system.

The resulting session could appear as:

alice@server:~$

The reverse shell provides the interactive command access. Examination of the Linux system after that access has been established is the Discovery activity.

Once access to the Linux system has been established, Discovery can begin from the privileges associated with that access. The first step is to establish the identity and privilege context of the current session.

The whoami command is used to determine the effective username associated with the current shell.

alice@server:~$ whoami
alice

The id command is used to display the user’s UID, primary group, and supplementary groups.

alice@server:~$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice)

This establishes the identity and privilege context under which the subsequent Linux Discovery activities are performed.

What Is Linux Discovery?

Linux Discovery is the systematic examination of an accessed Linux system to understand its identity, configuration, users, privileges, processes, services, network environment, storage, software, scheduled activity, and security controls.

Discovery is not simply a collection of commands. Each command provides a piece of information that can be correlated with other findings.

For example, discovering an active service becomes more meaningful when its process owner, listening port, installed package, configuration, and network exposure are considered together.

Why Linux Discovery Matters

After Initial Access, an attacker may know that access exists but still have very little understanding of the system.

Discovery helps answer fundamental questions about the host:

• What type of Linux system is this?
• What account am I using?
• What other accounts exist?
• What privileges are available?
• What applications are running?
• What services are exposed?
• What networks can the system reach?
• What files can the account access?
• What software is installed?
• What scheduled tasks are configured?
• What security controls are active?

For defenders, understanding these questions is equally important because it shows what an attacker may learn after obtaining access.

Linux Discovery Categories

Linux Discovery can be organized into several categories:

1. System Information Discovery
2. User and Group Discovery
3. Privilege Discovery
4. Process Discovery
5. Service Discovery
6. Network Discovery
7. Filesystem and Storage Discovery
8. File and Directory Discovery
9. Software and Package Discovery
10. Scheduled Task Discovery
11. Environment Discovery
12. Kernel and Security Configuration Discovery

System Information Discovery

System information establishes the basic identity and characteristics of the Linux host.

Operating System Information

The /etc/os-release file contains operating-system identification information.

The cat command is used to display the contents of the file.

alice@server:~$ cat /etc/os-release
NAME="Ubuntu"
VERSION="24.04.2 LTS (Noble Numbat)"
ID=ubuntu
ID_LIKE=debian
VERSION_ID="24.04"
PRETTY_NAME="Ubuntu 24.04.2 LTS (Noble Numbat)"

This identifies the Linux distribution and release.

Kernel Information

The uname -a command is used to display information about the running kernel and system architecture.

alice@server:~$ uname -a
Linux server 6.8.0-40-generic #40-Ubuntu SMP PREEMPT_DYNAMIC x86_64 GNU/Linux

Kernel information helps establish the core software environment of the system.

Hostname Information

The hostname command is used to identify the configured hostname.

alice@server:~$ hostname
server

The hostname provides context when identifying the system within an environment.

System Architecture

The arch command is used to display the processor architecture.

alice@server:~$ arch
x86_64

Architecture information helps determine the characteristics of the system and the compatibility of installed software.

User and Group Discovery

Users and groups are fundamental to Linux access control.

User Accounts

The /etc/passwd file contains information about local user accounts.

The cat command is used to examine the account database.

alice@server:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
alice:x:1000:1000:Alice:/home/alice:/bin/bash

The entries provide information such as usernames, UIDs, primary GIDs, home directories, and login shells.

User IDs and Group IDs

The id command provides the UID, primary GID, and supplementary groups for the current account.

alice@server:~$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice)

Linux uses numerical identifiers internally to represent users and groups.

Group Membership

The groups command displays the groups associated with a user.

alice@server:~$ groups
alice

Group membership can determine access to files, resources, applications, and administrative functions.

Login Shells

The echo "$SHELL" command displays the shell associated with the current environment.

alice@server:~$ echo "$SHELL"
/bin/bash

This provides information about the command environment available to the user.

Logged-In Users

The who command displays users currently logged into the system.

alice@server:~$ who
alice    pts/0        2026-08-23 10:24

This can reveal active interactive sessions on the host.

Privilege Discovery

Privilege Discovery determines what the current account is permitted to do and what administrative relationships exist.

Current User Identity

The whoami command is used to confirm the effective identity.

alice@server:~$ whoami
alice

This confirms the account under which the current shell operates.

User Privileges

The id command helps establish the current user’s identity and group memberships.

alice@server:~$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice)

The result establishes the privilege context from which subsequent Discovery is performed.

Sudo Configuration

The sudo -l command is used to display commands that the current user is authorized to execute through sudo.

alice@server:~$ sudo -l
Matching Defaults entries for alice on server:
    env_reset, mail_badpass

User alice may run the following commands on server:
    (ALL : ALL) ALL

This information establishes whether the account has delegated administrative capabilities.

The result depends on the system’s sudo configuration and the account’s authorization. A standard account should not be assumed to have unrestricted sudo access merely because the sudo command exists.

Administrative Groups

The groups command can help identify membership in groups associated with administrative capabilities.

alice@server:~$ groups
alice sudo

The significance of a group depends on the system’s configuration and the privileges assigned to it.

Process Discovery

Processes reveal what applications and tasks are currently executing.

Running Processes

The ps aux command is used to display running processes across the system.

alice@server:~$ ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.1  22500 11000 ?        Ss   09:10   0:02 /sbin/init
root         742  0.1  0.5 120000 52000 ?        Ssl  09:10   0:15 /usr/sbin/sshd
alice       2148  0.0  0.2  10000  5000 pts/0    Ss   10:24   0:00 -bash

The output provides process ownership, process IDs, resource consumption, and executed commands.

Process Ownership

Process ownership is important because processes execute with the permissions associated with their identities.

In the example above, sshd operates as root, while the shell operates as alice.

Process Details

The ps -ef command provides a detailed process listing, including parent-process relationships.

alice@server:~$ ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 09:10 ?        00:00:02 /sbin/init
root         742       1  0 09:10 ?        00:00:15 /usr/sbin/sshd
alice       2148    2100  0 10:24 pts/0    00:00:00 -bash

Parent and child relationships help explain how processes were started.

Resource Usage

The top command provides a continuously updated view of processes and system resource consumption.

alice@server:~$ top

It can reveal CPU consumption, memory consumption, process IDs, users, and system load.

Service Discovery

Services provide functionality to the operating system and other systems.

Running Services

On a systemd system, systemctl list-units --type=service is used to list loaded service units.

alice@server:~$ systemctl list-units --type=service
UNIT                     LOAD   ACTIVE SUB     DESCRIPTION
ssh.service              loaded active running OpenBSD Secure Shell server
cron.service             loaded active running Regular background program
systemd-journald.service loaded active running Journal Service

This provides visibility into services operating on the host.

Service Status

The systemctl status command is used to examine a specific service.

alice@server:~$ systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded
     Active: active (running)

Service status provides information about whether the service is running and how it is configured.

Service Configuration

The systemctl cat command displays the unit configuration associated with a service.

alice@server:~$ systemctl cat ssh
# /usr/lib/systemd/system/ssh.service
[Unit]
Description=OpenBSD Secure Shell server
After=network.target

Configuration information can help establish how the service operates.

Startup Services

The systemctl is-enabled command determines whether a service is configured to start automatically.

alice@server:~$ systemctl is-enabled ssh
enabled

Automatically enabled services should correspond to legitimate system requirements.

Network Discovery

Network Discovery determines how the Linux host communicates with its surrounding environment.

Network Interfaces

The ip addr command displays interfaces and assigned IP addresses.

alice@server:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
    inet 192.168.1.25/24 brd 192.168.1.255 scope global eth0

This identifies the interfaces through which the host communicates.

IP Addresses

The ip -br addr command provides a concise view of network interfaces and addresses.

alice@server:~$ ip -br addr
lo       UNKNOWN        127.0.0.1/8
eth0     UP             192.168.1.25/24

This quickly establishes the network addresses assigned to the host.

Routing Information

The ip route command displays the routing table.

alice@server:~$ ip route
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.25

Routing information reveals how traffic is forwarded to other networks.

DNS Configuration

The /etc/resolv.conf file commonly contains DNS resolver configuration.

alice@server:~$ cat /etc/resolv.conf
nameserver 192.168.1.1

DNS configuration helps explain how the host resolves domain names.

Network Connections

The ss -tunap command can be used to display network connections and associated processes when sufficient permissions and system visibility are available.

alice@server:~$ ss -tunap
Netid State  Local Address:Port   Peer Address:Port
tcp   ESTAB  192.168.1.25:22     192.168.1.50:51432

The availability of process and ownership information can be restricted for an unprivileged user. The exact output can vary between Linux distributions and system configurations.

Listening Ports and Sockets

The ss -tuln command is used to display listening TCP and UDP sockets.

alice@server:~$ ss -tuln
Netid State  Local Address:Port
tcp   LISTEN 0.0.0.0:22
tcp   LISTEN 127.0.0.1:5432

Listening ports reveal services accepting network connections.

Filesystem and Storage Discovery

Filesystem Discovery establishes how storage is organized and mounted.

Mounted Filesystems

The findmnt command displays mounted filesystems.

alice@server:~$ findmnt
TARGET SOURCE    FSTYPE OPTIONS
/      /dev/sda2 ext4   rw,relatime
/boot  /dev/sda1 ext4   rw,relatime

This provides an overview of mounted storage.

Disk Usage

The df -h command displays filesystem capacity in human-readable form.

alice@server:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        79G   32G   43G  43% /
/dev/sda1       974M  118M  790M  14% /boot

Disk usage reveals storage locations and capacity conditions.

Block Devices

The lsblk command displays disks, partitions, and their mount relationships.

alice@server:~$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   80G  0 disk
├─sda1   8:1    0    1G  0 part /boot
└─sda2   8:2    0   79G  0 part /

Mount Configuration

The /etc/fstab file contains persistent filesystem mount configuration.

alice@server:~$ cat /etc/fstab
UUID=8f3c... /     ext4 defaults 0 1
UUID=2a91... /boot ext4 defaults 0 2

This provides information about filesystems intended to be mounted automatically.

File and Directory Discovery

Files and directories reveal configuration, data, applications, and other resources.

File Ownership

The ls -l command displays ownership and permissions.

alice@server:~$ ls -l /etc/passwd
-rw-r--r-- 1 root root 2847 Aug 23 10:15 /etc/passwd

The output shows that the file is owned by root and belongs to the root group.

File Permissions

Linux permissions determine access for the file owner, group, and other users.

For example:

-rw-r--r--

means the owner has read and write permissions, while the group and other users have read permissions.

The stat command provides detailed metadata.

alice@server:~$ stat /etc/passwd
File: /etc/passwd
Size: 2847
Access: (0644/-rw-r--r--)
Uid: ( 0/ root)
Gid: ( 0/ root)

Special Permissions

Linux supports special permissions including set-user-ID (SUID), set-group-ID (SGID), and the sticky bit.

SUID Files

The SUID permission causes an executable file to run with the effective user ID of the file owner.

The following command is used to identify SUID files:

alice@server:~$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/mount
/usr/bin/umount

SUID files should be reviewed to determine whether their presence and permissions are appropriate for the system.

SGID Files

The SGID permission can be applied to executable files. When applied to an executable, the program runs with the effective group ID associated with the file.

The following command is used to identify SGID files:

alice@server:~$ find / -perm -2000 -type f 2>/dev/null
/usr/bin/chage
/usr/bin/expiry
/usr/bin/wall

SGID Directories

SGID also has an important directory-specific behavior.

When the SGID permission is applied to a directory, newly created files and subdirectories inherit the group ownership of the parent directory.

For example, a shared directory may have permissions such as:

drwxrwsr-x 2 root developers 4096 Aug 23 10:30 /shared

The s in the group-permission position indicates that SGID is enabled on the directory.

This behavior is commonly used for collaborative directories where multiple users need to work with files belonging to a common group.

From a Discovery perspective, SGID directories are relevant because they can reveal shared-work areas and group-based access relationships.

The following command can be used to identify directories with SGID enabled:

alice@server:~$ find / -type d -perm -2000 2>/dev/null
/shared
/var/shared

Sticky Bit

The sticky bit is commonly applied to shared directories where users need to create files but should not be able to remove or rename files belonging to other users.

A typical example is /tmp.

alice@server:~$ ls -ld /tmp
drwxrwxrwt 12 root root 4096 Aug 23 10:30 /tmp

The t at the end of the permission string indicates that the sticky bit is enabled.

Important System Files and Directories

Location	Purpose
/etc/passwd	Local user account information
/etc/group	Local group information
/etc/shadow	Password authentication information
/etc/os-release	Operating-system identification
/etc/hostname	Hostname
/etc/hosts	Local hostname mappings
/etc/resolv.conf	DNS resolver configuration
/etc/fstab	Filesystem mount configuration
/var/log/	System and application logs
/proc/	Kernel and process information
/sys/	Kernel and hardware information
/home/	User home directories
/tmp/	Temporary files

Access to these locations depends on the current account’s permissions.

Software and Package Discovery

Installed software identifies the applications and components present on the host.

Installed Packages

On Debian-based systems, dpkg -l lists installed packages.

alice@server:~$ dpkg -l | head
Desired=Unknown/Install/Remove/Purge/Hold
||/ Name Version
ii  adduser 3.137ubuntu1
ii  bash 5.2.21-2ubuntu4
ii  openssh-server 1:9.6p1-3ubuntu13

This provides a software inventory.

Package Information

The dpkg -s command displays information about an installed package.

alice@server:~$ dpkg -s openssh-server
Package: openssh-server
Status: install ok installed
Architecture: amd64

Software Versions

The ssh -V command displays the installed OpenSSH client version.

alice@server:~$ ssh -V
OpenSSH_9.6p1 Ubuntu-3ubuntu13, OpenSSL 3.0.13

Software versions support inventory and vulnerability assessment, but a version number alone does not establish that a component is vulnerable.

Scheduled Task Discovery

Linux provides several mechanisms for automatically executing tasks. Discovery should therefore examine both user-specific and system-wide scheduling mechanisms.

Cron Jobs

The crontab -l command displays scheduled jobs associated with the current user.

alice@server:~$ crontab -l
# m h dom mon dow command
0 2 * * * /home/alice/scripts/backup.sh

Scheduled tasks should be reviewed against the intended configuration.

System Cron Configuration

System-wide cron configuration can exist in /etc/crontab as well as dedicated cron directories.

The /etc/crontab file contains system-wide scheduled tasks and includes a user field that determines which account executes each task.

alice@server:~$ cat /etc/crontab
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
17 * * * * root cd / && run-parts --report /etc/cron.hourly

System-level scheduled tasks may execute with elevated privileges and therefore deserve particular attention.

/etc/cron.d/

The /etc/cron.d/ directory provides another location for system-wide cron job definitions.

The directory can contain separate configuration files for individual applications or services.

The ls -la command is used to inspect the directory.

alice@server:~$ ls -la /etc/cron.d/
total 20
drwxr-xr-x  2 root root 4096 Aug 23 10:30 .
drwxr-xr-x 95 root root 4096 Aug 23 10:30 ..
-rw-r--r--  1 root root  201 Aug 23 10:20 logrotate
-rw-r--r--  1 root root  312 Aug 23 10:20 sysstat

Individual files can then be examined to understand the scheduled activity they define.

alice@server:~$ cat /etc/cron.d/logrotate
17 * * * * root /usr/sbin/logrotate /etc/logrotate.conf

This location is important during Discovery because scheduled tasks may be distributed across multiple files rather than appearing directly in /etc/crontab.

/etc/anacrontab

/etc/anacrontab provides configuration for Anacron, which is designed for jobs that do not need to run at an exact time but should run periodically.

The file can be examined with:

alice@server:~$ cat /etc/anacrontab
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

1       5       cron.daily      run-parts --report /etc/cron.daily
7       10      cron.weekly     run-parts --report /etc/cron.weekly
@monthly 15     cron.monthly    run-parts --report /etc/cron.monthly

Anacron configuration is another source of scheduled-task information that should be considered during Linux Discovery.

Systemd Timers

Systemd-based Linux systems may also use timers instead of traditional cron mechanisms.

The systemctl list-timers command displays configured systemd timers.

alice@server:~$ systemctl list-timers
NEXT                         LEFT  LAST                         PASSED  UNIT
Sun 2026-08-23 15:00:00 IST  35min Sun 2026-08-23 14:00:00 IST 25min ago apt-daily.timer
Mon 2026-08-24 00:00:00 IST  9h    Sun 2026-08-23 00:00:00 IST 14h ago logrotate.timer

Timers provide another source of scheduled-activity information.

Environment Discovery

The environment determines how commands and applications operate within the current session.

Environment Variables

The env command displays environment variables associated with the current shell.

alice@server:~$ env
USER=alice
HOME=/home/alice
SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin

Environment variables can reveal useful configuration information.

PATH Configuration

The echo "$PATH" command displays directories searched when commands are entered without absolute paths.

alice@server:~$ echo "$PATH"
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

PATH configuration is relevant to understanding command execution.

Shell Environment

The printenv command can display a specific environment variable.

alice@server:~$ printenv HOME
/home/alice

This identifies the home directory associated with the current environment.

Kernel and Security Configuration

Discovery also examines kernel interfaces and defensive controls.

/proc Filesystem

The /proc filesystem exposes information about the kernel and running processes.

The following command displays memory information:

alice@server:~$ cat /proc/meminfo | head -5
MemTotal: 16384000 kB
MemFree: 2840000 kB
MemAvailable: 8120000 kB
Buffers: 184000 kB
Cached: 4120000 kB

The amount of information visible can depend on system configuration and permissions.

/sys Filesystem

The /sys filesystem provides information about devices, kernel subsystems, and hardware-related structures.

alice@server:~$ ls /sys
block bus class dev devices firmware fs kernel module power

Linux Security Modules

On systems using AppArmor, aa-status can display the state of AppArmor profiles.

alice@server:~$ aa-status
apparmor module is loaded.
18 profiles are loaded.
16 profiles are in enforce mode.
2 profiles are in complain mode.

On systems using SELinux, getenforce can display the enforcement state.

alice@server:~$ getenforce
Enforcing

The specific security mechanism depends on the Linux distribution and configuration.

Firewall Configuration

Firewall inspection must be considered in the context of the current privilege level.

A standard unprivileged account should not be assumed to have permission to inspect UFW configuration. Attempting to query UFW without the required privileges may fail.

From a standard-user context:

alice@server:~$ ufw status
ERROR: You must be root to run this application.

Where the account has authorized administrative access through sudo, the firewall status can be examined using:

alice@server:~$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       192.168.1.0/24

This distinction is important because the successful sudo ufw status example represents an account with the necessary administrative authorization, rather than an unrestricted standard-user capability.

Firewall configuration helps establish which network access is intentionally permitted.

Security Controls

Security controls can include:

• Firewalls
• Mandatory access controls
• Auditing
• Authentication controls
• Endpoint security
• File permissions
• Application controls
• Logging

Discovery of these controls helps establish the defensive environment surrounding the host.

Important Linux Discovery Locations

Several Linux locations are particularly useful when understanding the accessed system.

Location	Information
/etc/passwd	User accounts
/etc/group	Groups
/etc/shadow	Authentication information
/etc/os-release	Operating-system information
/etc/hostname	Hostname
/etc/hosts	Local hostname resolution
/etc/resolv.conf	DNS configuration
/etc/fstab	Filesystem configuration
/etc/crontab	System cron configuration
/etc/cron.d/	System-wide cron job definitions
/etc/anacrontab	Anacron configuration
/var/log/	Logs
/proc/	Kernel and process information
/sys/	Hardware and kernel information
/home/	User home directories
/tmp/	Temporary files

The information available to the current account depends on the permissions configured on the system.

A Structured Linux Discovery Approach

Discovery is most useful when performed systematically.

Establish System Identity

First determine the operating system, kernel, hostname, architecture, and basic system characteristics.

Understand Accounts and Groups

Determine the current account, available users, groups, UIDs, GIDs, and active sessions.

Review Privileges

Determine the permissions and administrative capabilities available to the current account.

Examine Processes and Services

Identify applications, processes, services, ownership, and startup configuration.

Examine Network Configuration

Review interfaces, addresses, routes, DNS configuration, connections, and listening ports.

Examine Storage and Permissions

Review mounted filesystems, disks, directories, file ownership, and permissions.

Review Software

Identify installed packages, applications, and relevant software versions.

Review Scheduled Activity

Examine user cron jobs, /etc/crontab, /etc/cron.d/, /etc/anacrontab, and systemd timers.

Review Security Controls

Identify firewalls, mandatory access controls, auditing, and other defensive mechanisms.

Correlate Findings

Individual findings become more meaningful when correlated.

For example, discovering a listening port identifies network exposure. Identifying the associated process shows what is providing the service. Identifying its owner establishes the privilege context. Examining the installed package and configuration provides additional context.

The combination provides a stronger understanding than any individual command.

Discovery Before and After Privilege Escalation

Discovery does not require root access.

A standard account can discover substantial information about the host:

alice@server:~$ whoami
alice

alice@server:~$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice)

The account can then perform Discovery within its permitted visibility.

After privilege escalation, the same categories can be examined again from a higher-privileged context.

Discovery as a Standard User

A standard account may be able to determine:

• System identity
• Its own privileges
• Users and groups
• Running processes
• Network configuration
• Services
• Installed software
• Accessible files
• Scheduled activity

Some information may be restricted.

Changes in Visibility After Privilege Escalation

Elevated privileges can provide access to information that was previously unavailable.

Examples may include:

• Protected configuration files
• Password authentication databases
• Restricted logs
• Processes with protected information
• Files belonging to other users
• Administrative service configuration

Repeating Discovery with Elevated Privileges

After privilege escalation, Discovery can be repeated to establish what additional information has become visible.

This is why Discovery and Privilege Escalation can interact throughout an attack rather than existing as completely isolated activities.

Linux Discovery and Privilege Escalation

Discovery and Privilege Escalation are separate phases of the Cyber Attack Lifecycle.

Discovery gathers information about the environment.

Privilege Escalation seeks to increase the permissions available to the attacker.

However, information discovered during Discovery can influence subsequent privilege-related activity. After privileges have been increased, Discovery may be performed again to identify resources that were previously inaccessible.

The distinction is important: Discovery establishes what the accessed environment contains and what the current account can see, while Privilege Escalation changes the level of access available to that account.

Linux Discovery from a Defensive Perspective

Understanding Discovery from an attacker’s perspective helps defenders determine what an attacker can learn after obtaining access.

A security team can use this knowledge to evaluate:

• Excessive information exposure
• Unnecessary administrative privileges
• Excessive group membership
• Unnecessary services
• Weak file permissions
• Excessive network exposure
• Inadequate logging
• Weak segmentation
• Poor configuration management

Discovery findings should be compared against the intended configuration of the system.

Common Linux Discovery Mistakes

Collecting Information Without Context

Collecting large amounts of information does not automatically produce useful security findings. Information must be interpreted according to the role of the host.

Treating Every Service as a Vulnerability

A running service is not automatically a vulnerability. Its purpose, configuration, authentication, network exposure, and security controls must be considered.

Ignoring Permissions

The existence of a file, process, or configuration item does not mean the current account can access or modify it.

This is particularly important when interpreting commands such as ss, sudo, and firewall-management utilities.

Focusing Only on Software Versions

Software versions are useful for inventory and vulnerability management, but a version alone does not establish exploitability or vulnerability.

Failing to Correlate Findings

A service, process, port, account, or permission becomes more meaningful when related information is considered together.

Assuming All Linux Systems Are Configured the Same Way

Different Linux distributions and installations can have different package managers, service-management systems, security controls, filesystem layouts, and default configurations.

Linux Discovery in the Cyber Attack Lifecycle

Linux Discovery is particularly associated with the Discovery phase of the Cyber Attack Lifecycle.

In an actual attack, however, Discovery may begin soon after Initial Access rather than waiting for every preceding activity to be completed.

Consider an authorized ethical-hacking assessment in which an attacker obtains command execution on a Linux server as a standard user. The assessor can then examine the system from that user’s perspective, determine what information is visible, and identify how the available access relates to the security posture of the host.

If additional privileges are subsequently obtained, the assessment can repeat the Discovery process to determine what additional information becomes accessible.

This approach mirrors how Discovery can occur within an actual attack while keeping the activity within an authorized ethical-hacking context.

Security Considerations

Linux Discovery should only be performed against systems for which appropriate authorization has been provided.

Organizations can reduce the information and privileges available to unauthorized users through:

• Least-privilege access
• Strong authentication
• Appropriate privilege separation
• Network segmentation
• Service minimization
• Secure file permissions
• Application hardening
• Security monitoring
• Centralized logging
• Configuration management
• Endpoint protection
• Regular vulnerability assessment

The objective is not to prevent legitimate administrators from obtaining necessary information, but to ensure that access to sensitive information and administrative capabilities is appropriately controlled.

Conclusion

Linux Discovery provides a structured way to understand a Linux system after Initial Access has been established. It examines the host from the perspective of the account currently controlling the session and progressively builds an understanding of the system.

The process covers system identity, users and groups, privileges, processes, services, networking, storage, files, software, scheduled activity, environment configuration, and security controls.

Discovery can begin with a standard account and can be repeated after privilege escalation when additional information becomes available. Understanding this process is valuable in ethical hacking because it demonstrates what an attacker can learn after obtaining access while also helping defenders identify and reduce unnecessary exposure.

References

MITRE – System Information Discovery, T1082
Covers discovery of operating-system and system information on compromised systems.

MITRE – Process Discovery, T1057
Covers discovery of running processes and their associated information.

MITRE – System Network Configuration Discovery, T1016
Covers discovery of network interfaces, addresses, routes, and related configuration.

MITRE – System Network Connections Discovery, T1049
Covers discovery of network connections available from a compromised system.

MITRE – File and Directory Discovery, T1083
Covers discovery of files and directories on compromised systems.

MITRE – Software Discovery, T1518
Covers discovery of installed software and applications.

MITRE – Scheduled Task/Job Discovery, T1053
Covers discovery of scheduled tasks and jobs used by operating systems and applications.

GNU – GNU Coreutils Manual
Documents core Linux utilities used throughout the Discovery activities, including cat, ls, stat, find, ps, and environment-related commands.

systemd – systemd Documentation
Provides official documentation for systemd services and timers used in Linux service and scheduled-task Discovery.