| user | secret (pass or hash) | service / where it worked |
|---|
| lead | what happened | result |
|---|
You missed a port. Did you run -p-? Re-check the full TCP scan and run UDP. SNMP and TFTP hide on UDP.
You missed a vhost. Fuzz the Host header, add names to /etc/hosts, re-run web enum against the name not the IP.
Wordlist too small. Move to directory-list-2.3-medium or raft-large, add extensions: .php .txt .bak .old .zip .git.
Re-read the versions. searchsploit every version again, read the CVE not just the exploit title.
Creds you already have. Sprayed them on every service? SSH, SMB, WinRM, the web login, the database.
Rabbit hole. If something ate 45 minutes with no movement, park it and enumerate a service you have barely touched.
Read what you skimmed. The path is often already in your linpeas or nmap output.
Fresh eyes. Which port have you spent least time on? That is usually the way in.