Data Loader applies the Field-Level Security permissions of the running user. If you can see the field in Salesforce and you log in to Data Loader, it can see that field. If you can't see the field, neither can Data Loader. So there's not a single list - it's based on your individual permissions.
The Metadata API used by the Force.com Migration Tool can always see all fields.
I didn't realize you were using the Data Loader CLI, with which I have no experience. I don't know whether it has the capability in itself to pull a list of visible fields for you. You can do this using Workbench's REST Explorer, however, or directly calling the REST API in your scripts. Issue a GET request to
<your domain>/services/data/v43.0/sobjects/<sobject name>/describe
"fields" key in the JSON response contains a list of maps, each of which contains the key
"name". Those are the fields you can see. If you don't feel like parsing JSON to make this dynamic, you can just copy and paste the list of fields out of the Workbench UI.
An alternate approach to perform a regular backup is to use the Weekly Data Export service, which inherently can see everything and can also include attachments and files.