# Credentials

> Techniques for harvesting Linux credentials post-exploitation, covering password files, hashes, SSH keys, memory dumps, and credential reuse strategies.

- **URL:** https://hackindex.io/platforms/linux/post-exploitation/credentials
- **Path:** Linux > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/linux/post-exploitation.md)
- **Published:** 2026-05-10
- **Updated:** 2026-08-11

Use this as the jump page when you have a shell and need reusable credentials fast. Run the quick triage, then drop into the focused technique page that matches what you’re seeing.

## Linux credential access techniques

Common locations to find credentials after gaining a shell:

- Shell history files for previously typed passwords
- Configuration files with hardcoded credentials
- Browser saved passwords and session tokens
- SSH private keys and agent sockets
- Environment variables and process memory

## Steps

- [Browser saved passwords](https://hackindex.io/platforms/linux/post-exploitation/credentials/browser-saved-passwords.md): Extracting credentials stored in browser password managers on Linux systems using filesystem access and decryption techniques during post-exploitation.
- [Credential hunting in files](https://hackindex.io/platforms/linux/post-exploitation/credentials/credential-hunting-in-files.md): Techniques for locating stored credentials in Linux files, configs, logs, and history files during post-exploitation to escalate privileges or move laterally.
- [Process secret hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/pprocess-secret-hunting.md): Enumerate running process memory and cmdline args to extract plaintext secrets, credentials, and sensitive data from live Linux processes.
- [Shell history credential hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/shell-history-credential-hunting.md): Extracts credentials and sensitive data from shell history files (.bash_history, .zsh_history) across user accounts during post-exploitation.
- [SSH keys and agent harvesting](https://hackindex.io/platforms/linux/post-exploitation/credentials/ssh-keys-and-agent-harvesting.md): Techniques for harvesting SSH keys and abusing agent forwarding on compromised Linux hosts to enable lateral movement across infrastructure.