Miscellaneous

Crack password hash using a wordlist generated by crawling their website CeWL see Password Mutations

Default web server path

OS	Path
Linux	`/var/www/html`
Windows	`C:\inetpub\wwwroot`
Windows Apache `C:\xampp\htdocs`

Try credential stuffing when stuck

Whenever SSH is open, under each user's home, there's probably a .ssh folder