Merge pull request #986 from captain-woof/patch-1

src/network-services-pentesting/6379-pentesting-redis.md

@@ -208,6 +208,8 @@ Please be aware **`config get dir`** result can be changed after other manually
 
 **This technique is automated here:** [https://github.com/Avinash-acid/Redis-Server-Exploit](https://github.com/Avinash-acid/Redis-Server-Exploit)
 
+Additionally, system users can also be discovered by checking with `config set dir /home/USER`, and upon confirmation, a new `authorized_keys` can be written to `/home/USER/.ssh/authorized_keys`. Use [redis-rce-ssh](https://github.com/captain-woof/redis-rce-ssh) to bruteforce this with a usernames wordlist and overwrite `authorized_keys`.
+
 ### Crontab
 
 ```