Skip to content
stellvia.dev

Credentials and Configuration

Look for credentials and configuration related to applications, users, and services you can already access. Do not search the entire filesystem indiscriminately.

Choose where to search for configuration files using EnvironmentFile and ExecStart from Processes and systemd and the readable scope found in File and Directory Permissions.

Commands to check

Section titled “Commands to check”

Additional check examples:

Terminal window
env
printenv
history
grep -RniE 'pass(word)?|secret|token|key|credential' <TARGET_DIRECTORY>
find <TARGET_DIRECTORY> -maxdepth <N> -type f
  • Purpose: Find credentials and configuration within the accessible scope.
  • Prerequisites: Limit searches to directories with a reason to inspect them. Do not search all of /.
  • What to inspect: .env, config.php, wp-config.php, EnvironmentFile, artifact metadata, SSH keys, and service startup arguments.
  • Expected output: Database credentials, Basic authentication credentials, Flask secret keys, SSH private keys, or SMTP passwords.
  • Interpretation: Record credentials together with the account they belong to and where they can be used. Treat reuse with another service as an inference until verified.
  • If a check fails: Inspect file permissions, other users’ home directories, path differences inside and outside containers, base64 / JSON / YAML, and credentials in startup arguments.
  • Alternative commands: grep -Rni --include='*.env' --include='*.conf' ..., find /opt/<app> -maxdepth 4 -type f -ls.
  • State change: Read-only. history and configuration files may expose secret values; redact them in writeups.

Map credentials to where they were used

Section titled “Map credentials to where they were used”

Do not record the secret values themselves. If a record lacks both the account and the first place the credentials were used, do not treat it as evidence that they could be reused.

  • Environment variables of PID 1 or service processes may hold credentials for SSH access as another user. See Processes and systemd for checks.
  • For passwords in Web application configuration, such as wp-config.php or .env, identify the login destination before checking whether a user can log in with the same string.
  • Map hashes or plaintext from an application database to users who can access SSH. Analyze hashes before using them.
  • Record an application’s cloud credentials alongside the permissions of its internal APIs or queue workers. Treat these separately from root privileges inside a container. See Containers and Namespaces for boundary checks.
  • systemd’s EnvironmentFile and ExecStart show which credentials a localhost administrative action runs with.