# Shell history credential hunting

> Extracts credentials and sensitive data from shell history files (.bash_history, .zsh_history) across user accounts during post-exploitation.

- **URL:** https://hackindex.io/platforms/linux/post-exploitation/credentials/shell-history-credential-hunting
- **Path:** Linux > Post-Exploitation > Credentials
- **Up:** [Credentials](https://hackindex.io/platforms/linux/post-exploitation/credentials.md)
- **Published:** 2026-02-17
- **Updated:** 2026-08-11

> [!WARNING]
> Run these techniques only on systems you are explicitly authorized to test. SSH keys and agent material are high-impact credentials. Do not alter key files or agent state, avoid copying keys unless explicitly approved, and handle any exports per the engagement’s storage and deletion requirements.

Histories give you exact commands, internal hostnames, and one-off credentials that never made it into configs.

## Common history files

```bash
ls -la ~/
tail -n 200 ~/.bash_history 2>/dev/null
tail -n 200 ~/.zsh_history 2>/dev/null
tail -n 200 ~/.sh_history 2>/dev/null
```

Also check service client histories:

```bash
tail -n 200 ~/.mysql_history 2>/dev/null
tail -n 200 ~/.psql_history 2>/dev/null
tail -n 200 ~/.rediscli_history 2>/dev/null
tail -n 200 ~/.sqlite_history 2>/dev/null
```

Interpretation:

- Look for `ssh`, `scp`, `rsync`, `curl`, `wget`, database clients, and `sudo` usage.
- Commands often include full internal DNS names and ports. Capture those for later phases.

## Grep histories for secrets and endpoints

```bash
grep -RIn --binary-files=without-match -E "pass(word)?|token|secret|api[_-]?key|bearer|authorization:|ssh .*@|jdbc:|mongodb://|postgres://|mysql://|redis://|ldap" ~ 2>/dev/null | head -n 200
```

What to do with results:

- If you get a full connection string, test it directly against the local service first if applicable.
- If it’s remote, keep the tuple and validate when you switch into lateral movement.

## Other user artifacts that routinely contain creds

```bash
find ~ -maxdepth 4 -type f 2>/dev/null \( -name ".git-credentials" -o -name ".netrc" -o -name ".npmrc" -o -name ".pypirc" -o -name ".env" -o -name "*.env" -o -name "config.json" -o -name "settings.json" \) -exec ls -la {} \;
```

Check Docker client auth if present:

```bash
sed -n '1,200p' ~/.docker/config.json 2>/dev/null
```

Interpretation:

- `.netrc` and `.git-credentials` can give you reusable HTTP credentials or tokens.
- Docker auth can map to private registries and service accounts.

##

## References

- [Bash manual](https://www.gnu.org/software/bash/manual/bash.html) - History file behavior
- [Zsh options](https://zsh.sourceforge.io/Doc/Release/Options.html) - History storage format