Lesson 4.3: Finding secrets left on hosts
Attackers who land on a server look for credentials before anything else: .env files, configuration files, shell histories, cron lines and private keys. Each found secret opens another system. Benchmarks rarely check for them, so defenders must look the same way attackers do. In the lab you search Northwind's order server for exposed secrets by name, by content and in histories and cron jobs, fix the permissions and remove what shouldn't be there, and, most importantly, list every secret that must now be rotated.
16 min
You will learn to
- Explain where secrets typically leak on hosts
- Find secret files with find
- Find secrets by content with grep
- Fix permissions and remove leaked values
- Plan rotation of exposed secrets
Key terms
- Secret
- Anything that grants access: passwords, API keys, tokens, private keys, connection strings.
- .env file
- A file of environment variables for an application, often holding credentials.
- Credential harvesting
- Searching a compromised host for stored credentials to move further.
- Secrets manager
- A service that stores secrets centrally and hands them to applications at run time (Vault, cloud secret managers).
- Rotation
- Replacing a secret with a new value and revoking the old one.
← Fewer services, smaller attack surface · All lessons · Protecting sessions and cookies →