Credentials In Files

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Showing 48 of 121. Open each catalog technique above to see them all.

Guides

• Exposed .git directory: git-dumper and secrets in the history 3 min read How to spot an exposed .git folder on a website, rebuild the repository with git-dumper and find passwords and keys in the commit history.
• Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

cd repo && git log --oneline && git show HEAD~1

git log -p | grep -iE 'pass|secret|token|key'

grep -rniE '(pass(word)?|pwd|secret|token)\s*[=:]' /var/www /opt /etc /home 2>/dev/null | grep -v '^Binary'

find / \( -name '*.conf' -o -name '*.config' -o -name '.env' -o -name 'wp-config.php' -o -name '*.kdbx' \) -readable 2>/dev/null | grep -vE '^/(proc|sys|usr/share)'

cat ~/.*history 2>/dev/null; ls -la /home/*/

grep -riE 'pass|login' /var/log 2>/dev/null

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

findstr /si /m "password" C:\inetpub\*.config C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini

$c = Import-Clixml -Path cred.xml; $c.GetNetworkCredential().Password

git log -p --all | grep -iE 'pass|secret|token|key'

Tools

• GIT git-dumper
• LP linPEAS