Secrets left in files

Look where apps keep their passwords

Software has to store the passwords it uses — to its database, to other services — somewhere on disk, usually in a config file. Developers mean to lock those files down and often forget. A web app lives under /var/www; read its config:

cat /var/www/app/config.php

In the terminal

student@vulntech:~$ cat /var/www/app/config.php
<?php
// Database connection settings
$DB_HOST = 'localhost';
$DB_USER = 'root';
$DB_PASS = 'S3rv3r-Adm1n-2024';   // TODO: move to env, rotate
$DB_NAME = 'appdb';

There is a database password sitting in plain text. On a machine with many files you would not read them one by one — you would search. grep -r walks a whole directory tree looking for a pattern:

grep -ri 'pass' /var/www 2>/dev/null

In the terminal

student@vulntech:~$ grep -ri 'pass' /var/www 2>/dev/null
/var/www/app/config.php:$DB_PASS = 'S3rv3r-Adm1n-2024';   // TODO: move to env, rotate

Tip: Good places to grep for leaked secrets: /var/www, /opt, a user's home and dotfiles, /etc, and backup files ending in .bak or ~. Search for pass, pwd, secret, token and key.