> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/password-mining.md).

# Password Mining

**Password mining is a critical step in post-exploitation and privilege escalation.**\
Attackers extract stored or hardcoded credentials from applications, config files, command history, or memory. These credentials may provide root access, lateral movement, or pivoting opportunities.

***

### Check Common Application Paths

Start by inspecting directories where apps and sensitive scripts may reside:

```bash
ls -lha /opt
ls -lha /home
ls -lha /root
```

***

### Browser Stored Credentials

Modern browsers store passwords in encrypted databases or flat files:

| **Browser**     | **Credential Storage Path**                                | **Notes**                         |
| --------------- | ---------------------------------------------------------- | --------------------------------- |
| Chrome/Chromium | `~/.config/google-chrome/Default/Login Data`               | SQLite DB, encrypted, use LaZagne |
| Firefox         | `~/.mozilla/firefox/*.default*/logins.json` + `key4.db`    | JSON creds + master key DB        |
| Opera           | `~/.config/opera/Login Data`                               | Similar format to Chrome          |
| Brave           | `~/.config/BraveSoftware/Brave-Browser/Default/Login Data` | Chrome-based                      |

***

### Email Clients

* Thunderbird
* Claws Mail

***

### Cloud Credentials

Cloud credentials stored by CLI tools can often lead to full account takeover:

| **Provider**     | **Credential Path**           |
| ---------------- | ----------------------------- |
| AWS              | `~/.aws/credentials`          |
| GCP              | `~/.config/gcloud/`           |
| Azure CLI        | `~/.azure/`                   |
| OCI              | `~/.oci/config`               |
| DigitalOcean CLI | `~/.config/doctl/config.yaml` |

***

### Network Environment

Wi-Fi credentials may be available on local systems:

```bash
cat /etc/NetworkManager/system-connections/*
```

Check for `psk=`, `password=`, or `ssid=` fields.

***

### Config and Log Files (Hardcoded Passwords / Secrets)

Use these commands to search common file names across the filesystem:

```bash
find / -type f -name "httpd.conf" 2>/dev/null
find / -type f -name "*.log" 2>/dev/null
find / -type f -name "config.inc.php" 2>/dev/null
find / -type f -name ".htpasswd" 2>/dev/null
find / -type f -name ".bash_history" 2>/dev/null
find / -type f -name ".mysql_history" 2>/dev/null
find / -type f -name "service.pwd" 2>/dev/null
find / -type f -iname "*config*" 2>/dev/null
```

Look for keywords like: `password=`, `passwd`, `secret`, `token`, `key`, etc.

***

### History Files

Command history may reveal reused passwords or credentialed commands:

```bash
cat ~/.bash_history
cat ~/.mysql_history
cat ~/.nano_history
cat ~/.viminfo
cat ~/.php_history
cat ~/.atftp_history
cat ~/.profile
cat /var/mail/root
cat /var/spool/mail/root
```

***

### SSH Keys and Configuration

SSH keys grant passwordless access. Check for private and authorized keys:

```bash
find / -type f -name "authorized_keys" 2>/dev/null
find / -type f -name "id_rsa" 2>/dev/null
find / -type d -name ".ssh" 2>/dev/null
```

```bash
cat ~/.ssh/id_rsa
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/authorized_keys
cat ~/.ssh/config
```

***

### Backup Files

Old or backup files often contain plaintext configs:

```bash
find / -type f \( -iname "*.bak" -o -iname "*.old" -o -iname "*.tar" -o -iname "*.zip" \) 2>/dev/null
```

Extract and inspect contents for sensitive information.

***

### Tool: LaZagne

* Extracts passwords from browsers, email clients, Wi-Fi configs, etc.
* Works on Linux, Windows, and macOS.

**Repo:** <https://github.com/AlessandroZ/LaZagne>

{% hint style="success" %}
**Password mining is not limited to specific locations or file types.**\
Credentials may reside anywhere — **config files**, **log files**, **browsers**, **memory**, **running applications**, **environment variables**, or **custom scripts, etc**.
{% endhint %}