In any case, whether you can escalate your privileges or not, having a definitive list of what permissions you do have is extremely important. This can save you a lot of time when attacking an environment as you don't need to spend time trying to guess what access you might have, and instead, you can do manual analysis offline to leave a smaller logging footprint. By knowing what access you have, you can avoid the need to run test commands to determine whether you have privileges or not. This is beneficial because API errors, especially access denied errors, can be very noisy, and will likely alert a defender to your activity.
In many cases, you might find that your user does not have enough permissions to be able to enumerate their full list of permissions. In these situations, it is generally recommended to make assumptions based...
