Searching for passwords in configuration files

An application provides an enticing target for attackers as weaknesses and vulnerabilities in it and its storage of credentials can lead to complete system compromise or elevated privileges.

This section will be focused on finding and enumerating application credentials. The techniques demonstrated in this section will depend on the type of target you are dealing with and its deployment use case. In our particular case, our target VM is set up to be a server and has various applications installed.

The first step of this process involves searching for passwords in various files stored locally; this will allow us to identify any user or application passwords in text or configuration files. This can be achieved through the use of inbuilt Linux utilities that allows us to search for specific strings in files with specific extensions.

Searching for passwords

We can get started with the password searching process by following the...