Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which do you grab first?

You only have the vulnerabilty at hand and nothing more of information (directory structure and similar is unknown at the point of compromise). The discovery and furter exploitation has to come from the file download vulnerability.

A few things come to mind:

  • Source code. Potential information leaks about backends, configurations and so on.
  • metabase.xml for IIS setups
  • autoexec.bat incase there is anything juicy at startup
share|improve this question
'passwords.xlsx' – Rubber Duck Mar 31 '14 at 19:53

To try to escalate, you could look for known versions of programs that are known to be vulnerable. You probably wouldn't need to download the whole thing, just enough to get the signature/version.

E.g. DLLs that would signal that an OS patch hasn't been applied. This would give you information you might want to launch another attack. (Or it would give you information that launching that attack would be useless and you should look elsewhere.)

share|improve this answer

Off-the-cuff stuff I could script:

  • Registry
  • SAM (these two require compromising at the kernel level -- leaving as a reference)
  • Active Directory DB
  • Browser histories & cookies
share|improve this answer
Registry (hive) and SAM is protected so you cant read them unless you log out of windows right? – Chris Dale Oct 17 '11 at 23:06
@Karrax very off-the-cuff answer. Yes, those are locked by the OS kernel and can't be read through normal FS access. – Jeff Ferland Oct 18 '11 at 16:06
Config files for any service applications would be useful too. For example, if it's running MySQL, you can grab my.ini to find the directory that contains the table data, then grab user.frm, user.MYD and user.MYI from the mysql table data directory. You can then use them to get the password hashes. Obviously this is just one example, the possibilities are endless in the case of software services. – Polynomial Oct 20 '11 at 18:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.