I am performing a penetration testing on an application hosted on an Ubuntu environment. 

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

 - Search for logs that can lead me to the path. nginx or apache2 is not there. 
 - Search for nginx, apache2 or other configuration files
 - Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)
 - Bash histories of all users


What else should I try?