Important files

Globally readable/writable files and folders

Files

Globally readable

find / \( -wholename '/home/*' -prune \) -o \( -type d -perm -0002 \) -exec ls -ld '{}' \; 2>/dev/null 
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null

No owner

find / -xdev \( -nouser -o -nogroup \) -print 2>/dev/null

Folders

Writable by current user or anyone

find / -writable -type d -exec ls -ld '{}' \; 2>/dev/null

User files enumeration

Enumerate home folders

find /home/*/ -type f 2>/dev/null
ls -lah /home/*
ls -lah /home/*/*

Search files globally by user

find / -type f -exec ls -lah '{}' \; 2>/dev/null | grep $(whoami)

Search globally for user-owned folders

find / -type d -exec ls -ld '{}' \; 2>/dev/null | grep $(whoami);

Writable by me

find / -writable -type f -exec ls -lah '{}' \; 2>/dev/null

Interesting files

cat ~/.bash_history
cat ~/.bashrc
cat ~/.profile

cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history

cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa

SSH keys

cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

Find SSH keys system-wide

find / -type f -and \( -name "*.key" -or -name "*.pub" -or -name "*rsa*" -or -name "*dsa*" \) -exec ls -lah '{}' \; 2>/dev/null

Config files

Dump config files in current folder

find . -type f -readable -and \( -name "*db*" -or -name ".ht*" -or -name "*conf*" -or -name "*.cnf" -or -name "*.ini" -or -name "*.json" \) -exec ls -lah '{}' \; 2>/dev/null

Search for passwords in config files

find . -type f -readable -and \( -name "*db*" -or -name ".ht*" -or -name "*conf*" -or -name "*.cnf" -or -name "*.ini" -or -name "*.json" \) -exec grep -E ".*pass.*|.*pwd.*|.*cred.*" '{}' \; 2>/dev/null

Search for hashes in config files. Finds md5, SHA1, SHA256, SHA512 with or without salt

find . -type f -readable -and \( -name "*db*" -or -name ".ht*" -or -name "*conf*" -or -name "*.cnf" -or -name "*.ini" -or -name "*.json" \) -exec grep -E "(^|[^a-zA-Z0-9])[a-fA-F0-9=_/\.$]{8,256}([^a-zA-Z0-9]|$)" '{}' \; 2>/dev/null

Log files

ls -lah cat /var/log/
ls -lah /var/log/*/
ls -lah /var/backup/

dump log files in current folder

find . -type f -readable -and \( -name "*.log" -or -name "*log*" \) -exec ls -lah '{}' \; 2>/dev/null