Sorry, should have left you the last line there, but I though just posting the breasts line would be weird. Feels like it's more obviously lyrics with two lines. (-:

A friend with breasts and all the rest

A friend who's dressed in leather

A friend in need is a friend indeed

No, states get a say in constitutional amendments

Sure yeah, we'd call that an assumed breach test. I'd still use Bloodhound for sure and toss in:
-Responder
-Digging through file shares
-Kerberoasting

Depends on scope/environment, but good starting points are:
- Externally exposed services (all MFA?)
- Bloodhound in Active Directory
- Scoutsuite for cloud assets

If your test machine is a VPS, be sure to forward a local port to your instance, e.g.,
ssh elgee@hackyhackmachine -L 7171:127.0.0.1:7171

Then you can browse to localhost:7171 and see the results of EyeWitness' hard work!

Love you, Ron. Such an animal!

YOU try it (-: