| Priority | Technique | Why |
|---|---|---|
| 1 | sudo -l → GTFOBins | Fast, reliable, very common |
| 2 | SUID binaries | Common misconfiguration |
| 3 | Cron jobs | Scripts running as root often writable |
| 4 | Password reuse / hunting | Configs frequently contain creds |
| 5 | Writable /etc/passwd | Old or misconfigured boxes |
| 6 | Capabilities | Underrated, often missed |
| 7 | NFS no_root_squash | Niche but instant root |
| 8 | Kernel exploits | Last resort · noisy, may crash |
in playbooks