Enumeration As A Core Skill

Observe, enumerate, correlate, prioritize, test.

How an experienced tester looks at...

Surface	What they look for first
Windows host	Local admins, scheduled tasks, services as domain accounts, unquoted paths, LAPS status, AV/EDR presence.
AD domain	Trusts, ACLs on privileged groups, delegation flags, SPNs, password policy, stale accounts, ADCS templates.
Unfamiliar network	Broadcast/mDNS/LLMNR/NBT-NS chatter, gateway behavior, DNS responses, VLAN boundaries.
Exposed service	Banner, auth model, version, default creds history, known unauth endpoints, misconfig patterns.
File share	ACLs vs share perms, config files, scripts, backup images, IT scratch folders, creds in comments.
Web app	Auth flow, session handling, IDs in URLs, admin surface, upload/parse, framework quirks, JS for endpoints.
Linux host	sudoers, SUID, cron, capability bits, world-writable configs, running services, container/kernel version.

Before any exploit, write a short 'what I know / what I suspect / what I need to prove' note. This alone separates operators from tool-runners.