Initial Enumeration
Web Server
Always check for config files
After getting Root or any user search for .sh files or passwords or ls -la and do check files in the root folder and also check for all the previous command typed on the system that console history