# Linux Sensitive Files
# Format: path|description
# Lines starting with # are comments

# === System Information ===
/etc/passwd|User accounts
/etc/shadow|Password hashes (requires root)
/etc/group|Group information
/etc/hosts|Host mappings
/etc/hostname|System hostname
/etc/resolv.conf|DNS configuration
/etc/fstab|Filesystem mount points
/etc/mtab|Mounted filesystems
/etc/issue|Pre-login message
/etc/motd|Post-login message
/etc/os-release|OS information
/etc/lsb-release|Linux distribution info
/proc/version|Kernel version

# === Network Configuration ===
/etc/network/interfaces|Network interfaces
/etc/sysconfig/network-scripts/|Network scripts (RHEL/CentOS)
/etc/hosts.allow|Allowed hosts
/etc/hosts.deny|Denied hosts
/etc/services|Service name-port mappings
/etc/protocols|Protocol numbers
/proc/net/tcp|TCP connections
/proc/net/udp|UDP connections
/proc/net/route|Routing table

# === User Information ===
/root/.bash_history|Root command history
/root/.ssh/id_rsa|Root SSH private key
/root/.ssh/authorized_keys|Root authorized keys
/root/.mysql_history|MySQL history
/root/.wget-hsts|Wget history
/home/*/.bash_history|User command history
/home/*/.ssh/id_rsa|User SSH private key
/home/*/.ssh/authorized_keys|User authorized keys
/home/*/.bashrc|Bash configuration
/home/*/.profile|User profile
/home/*/.mysql_history|MySQL history

# === Process Information ===
/proc/self/environ|Current process environment
/proc/self/cmdline|Current process command line
/proc/self/cwd|Current working directory
/proc/self/exe|Current executable
/proc/self/fd/|File descriptors
/proc/[pid]/environ|Process environment by PID
/proc/[pid]/cmdline|Process command line by PID
/proc/[pid]/maps|Memory maps

# === Web Server ===
/var/www/html/|Web root
/var/www/html/config.php|Web config
/var/www/html/wp-config.php|WordPress config
/var/www/html/.htaccess|Apache config
/var/www/html/.env|Environment file
/etc/apache2/apache2.conf|Apache config
/etc/apache2/sites-enabled/|Apache sites
/etc/nginx/nginx.conf|Nginx config
/etc/nginx/sites-enabled/|Nginx sites
/var/log/apache2/access.log|Apache access log
/var/log/apache2/error.log|Apache error log
/var/log/nginx/access.log|Nginx access log
/var/log/nginx/error.log|Nginx error log

# === Database ===
/etc/mysql/my.cnf|MySQL config
/etc/mysql/debian.cnf|Debian MySQL config
/var/lib/mysql/mysql/user.MYD|MySQL user data
/var/lib/mysql/mysql/user.frm|MySQL user table
/etc/postgresql/*/main/postgresql.conf|PostgreSQL config
/etc/postgresql/*/main/pg_hba.conf|PostgreSQL auth config

# === Application Configs ===
/app/.env|Application environment
/app/config.php|Application config
/app/config/database.yml|Database config
/config/database.yml|Rails database config
/config/settings.py|Django settings
/var/www/config.php|Web config alternative
/srv/www/config.php|Web config alternative
/app/config/parameters.yml|Symfony parameters
/.env|Root environment file

# === SSH ===
/etc/ssh/sshd_config|SSH server config
/etc/ssh/ssh_config|SSH client config
/root/.ssh/known_hosts|Root known hosts
/home/*/.ssh/known_hosts|User known hosts

# === Cron Jobs ===
/etc/crontab|System crontab
/etc/cron.d/|Cron jobs directory
/etc/cron.daily/|Daily cron jobs
/etc/cron.hourly/|Hourly cron jobs
/etc/cron.weekly/|Weekly cron jobs
/etc/cron.monthly/|Monthly cron jobs
/var/spool/cron/|User crontabs

# === Logs ===
/var/log/auth.log|Authentication log
/var/log/syslog|System log
/var/log/messages|System messages
/var/log/secure|Security log (RHEL/CentOS)
/var/log/boot.log|Boot log
/var/log/dmesg|Kernel ring buffer
/var/log/kern.log|Kernel log
/var/log/mail.log|Mail log
/var/log/cron|Cron log

# === Sudo ===
/etc/sudoers|Sudo configuration
/etc/sudoers.d/|Sudoers directory

# === SSL/TLS ===
/etc/ssl/certs/|SSL certificates
/etc/ssl/private/|SSL private keys
/etc/pki/tls/certs/|SSL certs (RHEL/CentOS)
/etc/pki/tls/private/|SSL keys (RHEL/CentOS)

# === Docker ===
/var/lib/docker/|Docker data
/etc/docker/daemon.json|Docker config
/proc/self/cgroup|Cgroup info (container detection)

# === Cloud Metadata ===
/var/lib/cloud/|Cloud-init data
