I am performing a penetration testing on an application hosted on an Ubuntu environment.

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

• Search for logs that can lead me to the path. nginx or apache2 is not there.
• Search for nginx, apache2 or other configuration files
• Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)
• Bash histories of all users

What else should I try?