> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/penetration-testing/process-stages/post-exploitation/useful-tips.md).

# Useful Tips

Here are some tips to help you get the most out of post-exploitation concepts, tools, and utilities:

* Use `hostname` and `whoami` commands
* Use `uname -a`
* Make `cat /proc/version` to get more information about the OS
* Make `cat /etc/issue` to know OS information
* Make `ps -A` to show running processes on the current shell (`ps axjf` for tree display mode)
* Use `env` to see environment variables
* Use `id` to obtain information about users and groups, or even information about another user
* Use `ls -la` to check hidden files
* Make `cat /etc/passwd | cur -d ":" -f 1` or `cat /etc/passwd | grep "home"` to know existing users 
* Check the last used commands with `history`
* Check network interfaces with `ifconfig` to know if it could be a pivoting point to another network. Then use `ip route` to confirm an interface cannot be accessed directly by the machine (it won't say it is a default interface).
* Use `netstat` to obtain information about listening ports and services running.
* Search for specific files with `find`
* Use tools such as *Linpeas* or *Linenum* for automation of the process
* Use `dpkg -l` on Linux or look at `C:\Program Files` in Windows, to see what software is installed on the system.
* Check for exposed credentials in configuration files of web apps or containers.
* Check if there are write permissions to add new cron jobs in the `/etc/crontab`, `/etc/cron.d`, or `/var/spool/cron/crontabs/root` folders to gain privileged shells or execute exploits.
* Use `base64` encode to convert a file to base64 format, and pass it in this way to a remote host to evade filtering of file types. To encode, we use `base64 $file -w 0` and to decode it with `echo $encodedstring | base64 -d > $file`
* Check the kernel version to find any possible exploit
* Use the `sudo -l`  command to check sudo execution permissions and environment options
* Check executables with *SUID* or *SGID* permissions
* Check which binaries have capabilities assigned
* Check which cron jobs are programmed to be executed
* Check cron jobs that may be deleted from the system but not from *crontab*
* Check writable folders that can be vulnerable to abuse of the *PATH* environment variable
* Check the NFS configuration files to create a connection with the host machine