Gaining an initial foothold on a system rarely gives full control; that foothold is usually a low-privileged account. Privilege escalation is the process of turning limited access into administrative, or root, access by abusing misconfigurations and flaws. On Linux, the classic avenues are misconfigured SUID binaries, insecure scheduled jobs, and outdated kernels. For a tester, systematic enumeration reveals these paths, and for a defender, understanding them drives the hardening that closes them off.
Analogy🏏Cricket
🏏 Think of it like cricket: Active recon is the captain walking out to inspect the pitch on match morning, pressing the surface, checking the grass, watching how the ball behaves in the nets. Unlike studying old footage from afar, this inspection happens on the ground itself and is visible to everyone. Just as that inspection reveals conditions no video could, active scanning reveals live services no public record shows, and just as it happens with the ground's permission, scanning happens only within authorized scope.