Skip to content
HackIndex logo

HackIndex

Process secret hunting

2 min read Feb 17, 2026

Secrets show up most often in command-line arguments, environment variables, and unit ExecStart lines.

Wide process view

┌──(kali㉿kali)-[~]
└─$ ps auxwwf

What you should see:

  • Full command lines including flags. Look for --password, --token, -p, Authorization, JDBC URLs, and inline creds.

  • Custom app paths under /opt, /srv, /var/www, or user home directories.

Next move:

  • Pick a suspicious PID and pull args and environment from procfs.

Pull a single process args and environment

Set $PID to a target PID you saw in ps.

┌──(kali㉿kali)-[~]
└─$ PID=<pid>
┌──(kali㉿kali)-[~]
└─$ tr '\0' ' ' < /proc/$PID/cmdline; echo
┌──(kali㉿kali)-[~]
└─$ tr '\0' '\n' < /proc/$PID/environ 2>/dev/null | sed -n '1,200p'

Interpretation:

  • If creds are in cmdline, you can usually reuse them immediately.

  • If creds are in environ, they often match .env files or systemd Environment entries. Hunt the source file next.

Identify files and sockets the process uses

┌──(kali㉿kali)-[~]
└─$ PID=<pid>
┌──(kali㉿kali)-[~]
└─$ ls -la /proc/$PID/fd 2>/dev/null | head
┌──(kali㉿kali)-[~]
└─$ lsof -p $PID 2>/dev/null | head -n 80

What to do with results:

  • Config file paths and log paths are the fastest pivot. Open the config file and look for static secrets.

  • Established connections reveal internal targets and ports. That becomes lateral movement planning later, but you can capture hostnames now.

Hunt for likely secret flags across all processes

┌──(kali㉿kali)-[~]
└─$ ps auxww | grep -Ei "pass(word)?=|token=|secret=|api[_-]?key=|authorization:|bearer" | grep -v grep

If the box is noisy, focus on common runtimes:

┌──(kali㉿kali)-[~]
└─$ ps auxww | grep -E "java|node|python3|python|gunicorn|uwsgi|dotnet|php-fpm" | grep -v grep

systemd ExecStart and environment (when readable)

If you have access to service definitions, you can often read the full command line and referenced config.

┌──(kali㉿kali)-[~]
└─$ systemctl list-units --type=service --state=running 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ systemctl cat <service> 2>/dev/null | sed -n '1,200p'
┌──(kali㉿kali)-[~]
└─$ systemctl show <service> -p Environment 2>/dev/null

Interpretation:

  • ExecStart points at the real binary and flags. If flags include secrets, capture them.

  • If it references a config path, open it and confirm whether the secret is static.

References