Secrets left in config files

A password anyone can read

Applications keep the passwords they use in config files, and those files are frequently readable by everyone. Look at the web app's config:

cat /var/www/app/config.php
grep -ri pass /var/www 2>/dev/null

In the terminal (a database password sitting in plain text, readable by any user)

student@vulntech:~$ cat /var/www/app/config.php
<?php
// Database connection settings
$DB_USER = 'root';
$DB_PASS = 'S3rv3r-Adm1n-2024';
$DB_NAME = 'appdb';
student@vulntech:~$ grep -ri pass /var/www 2>/dev/null
/var/www/app/config.php:$DB_PASS = 'S3rv3r-Adm1n-2024';

The danger is twofold: the password is exposed, and administrators reuse passwords — the same string often unlocks the database and the root account. A single readable config can hand an attacker the whole box.

Tip: Audit for secrets with grep -ri for words like pass, secret, token and key under /var/www, /opt, home directories and /etc.