> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/linux-priv/password-hunting.md).

# Password Hunting

### Password Hunting

```bash
# Tool based
./LinEnum.sh -t -k password

locate password

# Check hidden files
less .bash_history

# Check password keyword unders specific directories
grep pass /<login directory> /home /var/ opt/ <other obvious directory>
grep PASS /<login directory> /home /var/ opt/ <other obvious directory>

# Check filenames  
find / -name "*pass*" 2>/dev/null  
find / -name "*pass*" 2>/dev/null  -exec cp  {} /tmp/password/<directory> \;

# Look for something=something
grep -irE '(PASSWORD|password|pwd|pass)[[:space:]]*=[[:space:]]*[[:alpha:]]+' * 

# ID=sa;Password=CrimsonQuiltScalp193;

```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FpGfjT6pmju5zbc73E6Fi%2Fimage.png?alt=media&amp;token=01c55d47-6acd-4876-b3b8-79451811bf2a" alt=""><figcaption></figcaption></figure>