Overview
Finding escalation paths depends on enumeration — systematically gathering information about a system to identify weaknesses that could allow escalation. This lesson covers privilege-escalation enumeration.
Learning objectives
- Explain enumeration for privilege escalation.
- Describe what to enumerate on a system.
- Connect enumeration to identifying escalation paths.
Core concept
Privilege-escalation enumeration is methodically gathering information about a system (from the perspective of the access you have) to find misconfigurations and weaknesses that could enable escalation. It answers "what here could let me cross a privilege boundary?" Categories to enumerate (concept-level) include: permissions on files/objects, running services and their privileges, scheduled/automated tasks, installed software and versions (for known issues), credentials or sensitive data accessible, and configuration details. Thorough enumeration is what surfaces the paths that misconfigurations create.
How it works
Given some level of access (in an authorized test), the tester systematically inventories the system's relevant attributes — what files/objects are writable, what privileged services or tasks exist and whether the current user can influence them, what software/versions are present, and what credentials or sensitive data are readable. Each is examined for whether it weakens a privilege boundary. This mirrors the general enumeration discipline (methodical, documented) but focused on escalation opportunities. The findings are the candidate escalation paths, which are then validated safely. Automated enumeration aids can speed this up, but results are verified (false positives).
Practical example
In an authorized lab, having a low-privilege foothold, the tester enumerates the system: listing writable files, checking which services/tasks run with higher privileges and whether the current user can affect them, noting software versions, and searching for readable credentials. This surfaces a candidate escalation path — say, a privileged scheduled task that references a file the low-privilege user can modify. The path is documented for safe validation. Systematic enumeration turned "I have limited access" into "here is a specific way the boundary could be crossed."
Cybersecurity relevance
Enumeration is the core skill of privilege escalation (in authorized testing) because escalation paths must first be found — usually among misconfigurations. It mirrors what attackers do post-foothold, so understanding it aids detection (defenders can watch for escalation enumeration activity) and hardening (knowing what attackers look for guides what to lock down). It reflects the methodical, documented approach from the enumeration module, focused on escalation. Findings feed safe validation and remediation. Thorough enumeration is what makes escalation testing effective and, correspondingly, informs strong defense.
Common mistakes
- Unsystematic enumeration, missing escalation paths.
- Not verifying enumerated findings (false positives) before treating them as paths.
- Overlooking categories (tasks, credentials, service privileges) that commonly enable escalation.
Key takeaways
- Privilege-escalation enumeration methodically gathers system information (from current access) to find misconfigurations/weaknesses enabling escalation.
- Enumerate permissions, service/task privileges, software versions, accessible credentials, and configuration — checking each for weakened boundaries.
- It is the core skill for finding escalation paths (mirroring attackers), informing detection and hardening; findings feed safe validation.
Check your understanding
- What kinds of information do you enumerate when looking for privilege-escalation paths?
- Why does understanding escalation enumeration help defenders as well as testers?