Password Hunting

cat ~/.bash_history

cat ~/.zsh_history

cat /home/*/.bash_history 2>/dev/null

cat /root/.bash_history 2>/dev/null

find / -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null

cat ~/.ssh/id_rsa

find / -name "wp-config.php" 2>/dev/null

find / -name "config.php" 2>/dev/null

find / -name "database.yml" 2>/dev/null

find / -name "settings.py" 2>/dev/null

find / -name ".env" 2>/dev/null

find / -name "*.conf" 2>/dev/null | xargs grep -l "pass" 2>/dev/null

cat /var/www/html/config.php 2>/dev/null

cat /var/www/html/wp-config.php 2>/dev/null

cat /etc/mysql/my.cnf 2>/dev/null

cat /etc/apache2/apache2.conf 2>/dev/null

grep -rl "password" /var/www/ 2>/dev/null

grep -rl "passwd" /etc/ 2>/dev/null

grep -ri "db_pass\|DB_PASS\|password\|passwd\|secret\|token\|api_key" /var/www/ 2>/dev/null

find / -name ".git" -type d 2>/dev/null

git -C /path/.git log --oneline 2>/dev/null   # Old commits may have creds

cat /etc/shadow 2>/dev/null

find / -name "*.bak" -o -name "*.backup" -o -name "*.old" 2>/dev/null