1. sudo -l
2. check all config files, specially mysql creds...
2 check ls -al /etc/passwd -- cat /etc/passwd
3. find / -perm /5000 2>/dev/null ; find / -perm /4000 2>/dev/null
4. pspy for finding cron tasks
5. writable files