[Pauldotcom] what files do you go for when you compromise a machine?

[Robin Wood]

On 3 February 2010 02:50, Mike Patterson <mike at snowcrash.ca> wrote:
> Robin Wood wrote on 10-02-02 1837 :
>> Linux
>> .ssh/* - may as well grab everything
>> .bash_history
>
> Not all shells store things in .bash_history...
> I used to be a tcsh user, so .history.  Not sure about non-csh/non-bash
> shells, but .??*history* might work - then you get mysql and perhaps
> postgres history files too.
>
> Mike
>

Sounds good, I like your thinking.