The cron entry nobody wrote
A web server reaches out to an unknown address every five minutes. Find the cron entry that does it, the account it runs as, and the address.
Briefing
The network team flagged web-02: every five minutes it opens a connection to an address nobody recognizes. The application team says they did not schedule anything new.
You have a read-only shell on web-02. Check the system crontab, the cron.d drop-in directory, and the per-user crontabs.
web-02 · Persistence hunting
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.