Credential Hunting

• might be found in:
  • config files - .conf, .config, .xml
  • shell scripts, users bash history,
  • backup files (.bak) , db files, text files
• these can help get root, dbs, other systems in the env
  
• /var - web root for the web server on host
• can contain creds to the service or db or more.

Get MySQL DB creds with WP config

• grep 'DB_USER\|DB_PASSWORD' wp-config.php

spool or mail dirs

• find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null

SSH Keys

• search around the system for accessible SSH private keys (id_rsa)
• when we find an SSH key, check the known_hosts to find targets
  • known_hosts contains a list of public keys for all the hosts which the user has connected to in the past.
• ls ~/.ssh