> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/user-home-directory-enumeration.md).

# User Home Directory Enumeration

User home directories often contain personal configuration files, credentials, SSH keys, saved scripts, and development environments that can be useful for privilege escalation.

***

### Locate User Home Directories

```bash
cat /etc/passwd
```

Look for lines like:

```
username:x:1001:1001::/home/username:/bin/bash
```

* `/home/username` — Standard user
* `/root` — Root user

You can quickly list all home directories:

```bash
ls -lha /home
```

```
ls -lha /root
```

***

### Common Files to Check

```bash
ls -lha /home/<username>/
```

```
ls -lha /root/
```

#### Key Files:

| File/Dir                    | Description                                                           |
| --------------------------- | --------------------------------------------------------------------- |
| `.bash_history`             | Command history                                                       |
| `.bashrc`, `.profile`       | Environment customizations (check for aliases, PATH changes, secrets) |
| `.ssh/`                     | SSH private/public keys, authorized keys                              |
| `.gitconfig`, `.git/`       | Git repos and configuration                                           |
| `.viminfo`, `.nano_history` | Text editor history                                                   |
| `.aws/`, `.config/`         | Application/cloud configs                                             |
| `.gnupg/`                   | GPG keyring                                                           |
| `.docker/config.json`       | Docker credentials                                                    |

Users often name files with meaningful names:\
`credentials.txt`, `notes.txt`, `passwords.doc`, etc.

```bash
find /home/username -type f | grep -iE "cred|pass|secret|note|todo"
```