Credential Discovery — Where Creds Hide
Companion to Attack Path Graph > Credential Discovery Paths and Credential Graph. Run this checklist on every shell before privesc-only tunnel vision.
📌 Hunt List
| Source | Where to look | Tools |
|---|---|---|
| Linux passwd/shadow | /etc/passwd, /etc/shadow, /etc/group | Registry Hives and Linux Equivalents · Linux · John |
| Config files | /var/www, web.config, .env, appsettings.json | grep -ri pass, grep |
| Backups | .bak, .old, .zip, backup.sql | Gobuster -x bak,zip,sql |
| Database files | *.db, *.sqlite | SQLite · find |
| Env vars | env, /proc/*/environ | strings, cat |
| History | .bash_history, PowerShell history | manual |
| SSH keys | ~/.ssh/id_rsa, /etc/ssh | SSH · ssh2john → John |
| SAM / LSASS | Windows local/domain — LSASS = live sessions | LSASS · Registry Hives and Linux Equivalents · Mimikatz · secretsdump |
| Registry | AutoLogon, saved creds | Windows PrivEsc |
| Scheduled tasks | Task scripts with passwords | schtasks, Windows PrivEsc |
| POP3/IMAP inboxes | Mail (SMTP POP3 IMAP) · grep -i pass | |
| LDAP descriptions | User attrs | ldapsearch |
| Shares | SMB readable | smbclient · smbmap |
| Browser | saved passwords | Firefox Credentials - firefox_decrypt · LaZagne · nxc -M firefox |
📌 Quick Commands
# Linux
grep -riE "pass|password|secret|key" /var/www 2>/dev/null
find / -name "*.db" -o -name "*.sqlite*" 2>/dev/null
find / -name "id_rsa" -o -name "*.pem" 2>/dev/null
find /home -path "*/.mozilla/firefox/*/logins.json" 2>/dev/null # Firefox saved logins
cat /etc/passwd; sudo -l; env
# Windows (CMD/PS)
dir /s /b *pass* *cred* *.config 2>nul
cmdkey /list
# PowerShell history → **[[PowerShell History - PSReadLine]]**
(Get-PSReadlineOption).HistorySavePath
type %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt📌 After You Find Something
→ Open Credential Graph — map artifact to next action (login, PtH, Kerberoast, etc.)
→ Reuse everywhere: nxcspray, Hydra, CrackMapExec - nxc, evil-winrm, SSH, Impacket