Skip to content
HackIndex logo

HackIndex

Shell history credential hunting

2 min read Feb 17, 2026

Histories give you exact commands, internal hostnames, and one-off credentials that never made it into configs.

Common history files

┌──(kali㉿kali)-[~]
└─$ ls -la ~/
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.bash_history 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.zsh_history 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.sh_history 2>/dev/null

Also check service client histories:

┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.mysql_history 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.psql_history 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.rediscli_history 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ tail -n 200 ~/.sqlite_history 2>/dev/null

Interpretation:

  • Look for ssh, scp, rsync, curl, wget, database clients, and sudo usage.

  • Commands often include full internal DNS names and ports. Capture those for later phases.

Grep histories for secrets and endpoints

┌──(kali㉿kali)-[~]
└─$ grep -RIn --binary-files=without-match -E "pass(word)?|token|secret|api[_-]?key|bearer|authorization:|ssh .*@|jdbc:|mongodb://|postgres://|mysql://|redis://|ldap" ~ 2>/dev/null | head -n 200

What to do with results:

  • If you get a full connection string, test it directly against the local service first if applicable.

  • If it’s remote, keep the tuple and validate when you switch into lateral movement.

Other user artifacts that routinely contain creds

┌──(kali㉿kali)-[~]
└─$ find ~ -maxdepth 4 -type f 2>/dev/null \( -name ".git-credentials" -o -name ".netrc" -o -name ".npmrc" -o -name ".pypirc" -o -name ".env" -o -name "*.env" -o -name "config.json" -o -name "settings.json" \) -exec ls -la {} \;

Check Docker client auth if present:

┌──(kali㉿kali)-[~]
└─$ sed -n '1,200p' ~/.docker/config.json 2>/dev/null

Interpretation:

  • .netrc and .git-credentials can give you reusable HTTP credentials or tokens.

  • Docker auth can map to private registries and service accounts.

References