firefox:
- bookmarks n stuff in
~/.mozilla/firefox/<profile_folder>/places.sqlite
- creds in
~/.mozilla/firefox/<profile_folder>/logins.json
- creds encryption key in
~/.mozilla/firefox/<profile_folder>/key4.db
chrome
- bookmarks in
~/.config/google-chrome/Default/Bookmarks
- creds in
~/.config/google-chrome/Default/Login Data
system
- env variables
- config files
/etc/ (Linux)
/etc/passwd → user accounts (hashes usually in /etc/shadow)
/etc/shadow → password hashes (root-only)
/etc/ssh/ssh_config & /etc/ssh/sshd_config → key locations and configs
/etc/mysql/my.cnf → DB creds
/etc/postgresql/ → DB creds
/etc/nginx/, /etc/apache2/ → basic auth files
- App configs in user directories:
~/.config/ or ~/.<app> folders (e.g., ~/.aws/credentials, ~/.gitconfig)