Now let's briefly talk about passwords and we can drop down into a shell here and I say briefly because
there is a lot of password hunting that can be done.
But we're going to be able to automate that as you're going to see in the upcoming tools lesson and
you're going to be able to see in the password one hunting section of the course.
But we have to think about passwords being in files now from a pure pen test perspective.
I see passwords and files all the time.
If I get onto a user computer or I get into some kind of share drive people just store passwords and
files is what they do.
But this could been more than just that.
We could be talking about the same file which would store our hashes on Windows.
If there is a backup that laying around or something called unattended X a metal which is used sometimes
in stores passwords we talk about Wi-Fi passwords.
Think about somebody taking their computer home getting on their network using the same password they
use for their Wi-Fi at home and then using that as their work credentials or something along those lines.
So there's passwords that are stored in clear text for Wi-Fi.
There's a lot of things that are out there where passwords can be stored passwords could also be stored
in the registry.
And I'll show you some of these things and we'll do a quick overview of kind of what we're looking for
and how it works.
And then we're going to look in the tool section see how that works when it's automated and do a lot
of this legwork for us then we'll we'll see how it comes all together later on and we actually exploit
this and we see how passwords can be dangerous.
But from a pure password perspective super super common at least in real pen testing and something to
always look for when we're talking about this capture the flag style print ESC environment.
So I'm here in this iiNet serve and we can do a quick find string so to say something like find string.
We do a slash s I and we're just going to search for maybe the phrase password and we can search for
that and just stop T X T for example and this is going to find nothing.
We could go back a directory so it's only searching in the directory.
We could go back one directory to system 32 and maybe all this copy this and paste it here.
And if we want to search more files we could we could say some like I and I don t t maybe like dot config
this will add time to our search but we could try to hunt these down now well this is going this might
take a minute as we're looking through the whole system 30 to we can go ahead and just kind of look
at some resources that I actually really like and we'll we'll go from there and actually just finish
pretty quickly here so you can see what he's trying to do.
It's looking for the phrase password and you can see it comes into play here in this hash tables and
it really doesn't look like it's anything and just looks like it's a configuration or just a basic dot
t t.
Same thing here.
So we're going to find a bunch of these things we might have to sift through but it's just part of the
numerator process and somebody might have maybe on their desktop just like password is equal to my password
1 2 3 or something along those lines or think of like a sequel configuration or a web configuration
and that's why we search maybe those DOT config files to try to look for different passwords that we
might be able to use to escalate.
Now those resources this just goes back to the resources we pointed out in the first section of the
course.
Here's a clear text password section.
Now if you'd like to do this the complete manual way there's a bunch of different ways to do this.
Right.
You can search for the term you could search in files again this unattended X AML.
There's the NCD ionized registry the payloads all the things is more my favorite one to kind of have
and look through.
So you have the Sam again search file contents all different kinds of cool little things and tricks.
And if you really want to scare yourself you can do the Wi-Fi password that you can show your Wi-Fi
passwords here and see the password of your Wi-Fi network in clear text.
So I recommend if you're using the same password your Wi-Fi not to do that because it's very easy to
pull it down.
So with all that being said this is just a very very high level over you.
We're going to get into it as I said already we're going to get into it in a little bit so stay tuned
for the next few sections of the course as we actually search a dive in and utilize this and you'll
see where these passwords really come into play.
So we've got one more video in this section we're going to quickly talk about discovering firewalls
and antivirus and how we can determine if they're enabled in a network.
So let's go ahead and jump over to that video.