Rootbase

When a database answers from the network, do not assume its highest level account is protected. A server handed down between teams for years often keeps its most powerful login wide open with no password set at all. Try connecting as the top-level account with nothing, and look at which databases it lets you browse.

After gaining a foothold, check what your user can run as root. If any interpreted language appears in that list — something designed to execute arbitrary code — cross-reference it with GTFOBins. A single line is often all that stands between a low-privilege shell and full root access.