1

I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be passed a password (and hence which provide authentication).

Do you know of a comprehensive list of such tools? I couldn't find any. However, my first thoughts included the following tools:

  • wget
  • curl
  • nc
  • ssh
  • scp
  • ftp
  • telnet
  • git
  • mysql
  • sftp

Am I missing important ones?

Improve this question
5
  • Although you want this for a post-exploitation script, the question itself is not a security question. What you want to do is to search all man pages for password parameters. That can be done by: unix.stackexchange.com/questions/226686/…
    – schroeder ♦
    Commented Jan 17, 2019 at 12:08
  • A lot of people abuse the OpenSSL command line utility for file encryption and give it the password as a command line argument, which you could certainly add to your list.
    – forest
    Commented Jan 17, 2019 at 12:42
  • I would think sudo could also earn a spot on this list
    – jonroethke
    Commented Jan 17, 2019 at 18:57
  • unzip might also find its way on your list as the -P flag has potential security implications explained here
    – jonroethke
    Commented Jan 17, 2019 at 19:00
  • @waymobetta I think sudo intentionally does not take passwords on the command line for that very reason. Though GnuPG and various file archivers like 7z may.
    – forest
    Commented Jan 19, 2019 at 8:16

0

Reset to default

Browse other questions tagged .