Navigate
Collect command history, scripts, and SSH client artifacts useful for identifying SSH tunneling and pivoting commands
10 paths
C:\Users\%user%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PowerShell command history may contain ssh, plink, and pivot tool commands
C:\Users\%user%\.bash_history
Bash history may contain ssh tunneling and pivot commands
C:\Users\%user%\.zsh_history
Zsh history may contain ssh tunneling and pivot commands
C:\Users\%user%\*.ps1
User-created PowerShell scripts may contain pivoting commands
C:\Users\%user%\*.bat
Batch scripts may contain ssh, plink, or netsh portproxy commands
C:\Users\%user%\*.cmd
CMD scripts may contain ssh, plink, or netsh portproxy commands
C:\Users\%user%\*.sh
Shell scripts may contain ssh tunneling and proxy commands
C:\Users\%user%\.ssh\known_hosts
known_hosts records SSH servers previously connected to
C:\Users\%user%\.ssh\config
SSH config may contain port forwarding or tunneling settings
C:\Users\%user%\.ssh\*
SSH directory may contain keys, configs, and other connection artifacts