I came across a file, that was used by our tech support, to store all generic usernames and passwords in them for use with new systems. (Our company has been trained on the use of other Password storage tools, so this isn't a matter of training. The problem is that these files now exist on our network from before the team was trained. Generic accounts are already planned on being phased out as well.)

I noted this to our CISO and we have been trying to come up with a good solution as to how we can identify similar files in our network. We figured that since we have access to AD, we can probably search through all user accounts to find all instances of the first file. The problem is not necessarily what we know, but what we don't know. We want to make sure we find any instances of files used as password repositories. Are there any tools, open source or proprietary, that would accomplish this goal?

  • You would need to have some common thing to search for. I'm not sure there would be in this case. Your stated goal is to find files that could contain any kind of data: usernames and passwords, which would be unique between people by definition. At best, search for files labeled "passwords". – schroeder Nov 13 '14 at 21:05
  • Cheers, I think that the fellas over at serverfault.com might know more about corp network searching. Though I'm certain there is overlap here as well. – Andrew Hoffman Nov 13 '14 at 21:07

There are two approaches I would look into in order to accomplish this. The first is "Cornell Spider", it has the capabilities of looking inside of files for patterns. It's typically used to search for data such as social security numbers, PII, CC data. It is flexible enough that if the sheet you found has any patterns, you can hone in on those patterns and created a regular expression to search for.

An alternative way, is let's suppose that the file you found contains usernames and email addresses. Say: james.smith@mycompany.com You can use Powershell on a Windows machine to find files that contain those strings:

Get-ChildItem  -rec | ?{ findstr.exe 
/mprc:. $_.FullName } | select-string 

On a Unix based machines you could do the same thing but 1) it's really ugly, noisy, and long:

find / | xargs grep -i "@mycompany.com" >> /tmp/POSSIBLE-PII.txt

It all boils down to how that file has data structured. There are also commercially available tools that will do similar searches. Had I to tackle this, I would look for a commonality of what was in the file you found (usernames, amount of characters, domains, etc) and create a regular expression to look for files with those commonalities.

The issue with commercial tools, is they will likely be pre-populated with canned searches (SSN, CC, medical codes, etc). You are needing to find specifics. You could loop what you already discovered into another search. E.g., suppose the file you had was named passwordlist.txt you could iterate through every line, and have grep or powershell look for those instances in other files.

| improve this answer | |
  • It looks like Spider is out of support. However, the functionality appears to be exactly what I was looking for. I'm not strong with powershell, however, I can regex fairly well. This is the type of program that I can modify to meet my requirements. – pr- Nov 14 '14 at 15:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.