PaulDotCom mailing list archives

what files do you go for when you compromise a machine?


From: dninja at gmail.com (Robin Wood)
Date: Wed, 3 Feb 2010 07:53:18 +0000

On 3 February 2010 02:50, Mike Patterson <mike at snowcrash.ca> wrote:
Robin Wood wrote on 10-02-02 1837 :
Linux
.ssh/* - may as well grab everything
.bash_history

Not all shells store things in .bash_history...
I used to be a tcsh user, so .history. ?Not sure about non-csh/non-bash
shells, but .??*history* might work - then you get mysql and perhaps
postgres history files too.

Mike


Sounds good, I like your thinking.


Current thread: