> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/password-attacks/linux-local-password-attacks/credential-hunting-in-linux.md).

# Credential Hunting in Linux

### **Files**

```bash
# Configuration Files

# Find Configuration Files
for l in $(echo ".conf .config .cnf");do echo -e "\\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\\|fonts\\|share\\|core" ;done

# searching user,password,pass strings in configuration files
for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\\|lib");do echo -e "\\nFile: " $i; grep "user\\|password\\|pass" $i 2>/dev/null | grep -v "\\#";done

# Databases

# Find databases files
for l in $(echo ".sql .db .*db .db*");do echo -e "\\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\\|lib\\|headers\\|share\\|man";done

# Notes
find /home/* -type f -name "*.txt" -o ! -name "*.*"

# Scripts

# Find Scripts with different Extensions
for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\\|lib\\|headers\\|share";done
```

### **Cronjobs**

```bash
# find running Cron jobs 
cat /etc/crontab

ls -la /etc/cron.*/
```

### **SSH Keys**

```bash
# SSH Private Keys
grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"

# SSH Public Keys
grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"
```

### History

```bash
# Bash History
tail -n5 /home/*/.bash*
```

**Logs**

```bash
# Searching for interesting information in logs
for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\\|session opened\\|session closed\\|failure\\|failed\\|ssh\\|password changed\\|new user\\|delete user\\|sudo\\|COMMAND\\=\\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\\n#### Log file: " $i; grep "accepted\\|session opened\\|session closed\\|failure\\|failed\\|ssh\\|password changed\\|new user\\|delete user\\|sudo\\|COMMAND\\=\\|logs" $i 2>/dev/null;fi;done
```

Many different logs exist on the system. These can vary depending on the applications installed, but here are some of the most important ones:

| Log File            | Description                                        |
| ------------------- | -------------------------------------------------- |
| /var/log/messages   | Generic system activity logs.                      |
| /var/log/syslog     | Generic system activity logs.                      |
| /var/log/auth.log   | (Debian) All authentication related logs.          |
| /var/log/secure     | (RedHat/CentOS) All authentication related logs.   |
| /var/log/boot.log   | Booting information.                               |
| /var/log/dmesg      | Hardware and drivers related information and logs. |
| /var/log/kern.log   | Kernel related warnings, errors and logs.          |
| /var/log/faillog    | Failed login attempts.                             |
| /var/log/cron       | Information related to cron jobs.                  |
| /var/log/mail.log   | All mail server related logs.                      |
| /var/log/httpd      | All Apache related logs.                           |
| /var/log/mysqld.log | All MySQL server related logs.                     |

### **Memory and Cache**

```bash
# Download - <https://github.com/huntergregal/mimipenguin>

# Memory - Mimipenguin
sudo python3 mimipenguin.py
sudo bash mimipenguin.sh

# Lazagne
# Memory - Lazagne
sudo python2.7 laZagne.py all
```

**Browsers**

```bash
# Firefox Stored Credentials
ls -l .mozilla/firefox/ | grep default
cat .mozilla/firefox/1bplpd86.default-release/logins.json | jq .

# Decrypting Firefox Credentials
# Decrypt tool - <https://github.com/unode/firefox_decrypt>
python3.9 firefox_decrypt.py

# Lazagne 
# LaZagne can also return results if the user has used the supported browser.
python3 laZagne.py browsers
```