Credential-Hunting - CredsHunter - Credential Hunting scripts for Wind

项目说明

<di="center">

<img src="assets/credshunter-icon.svg" alt="CredsHunter" width="148" />

CredsHunter

Find credentials that can actually be reused for lateral mo or pri escalation.

<br>

!read-only
!no network
!
!bash
!PowerShell

</div>

O

CredsHunter is a read-only credential discovery toolkit for authorized internal penetration testing and post-exploitation.

It searches Linux and Windows hosts for credential material that is realistically useful during an engagement: plaintext passwords, database connection strings, private keys, credential containers, reusable hashes, shell-history credentials, GPP cpassword , unattended-install credentials, and other high-value local artifacts.

The project deliberately does not target cloud / SaaS access tokens such as JWTs, AWS access keys, GitHub tokens, Slack tokens, or generic API keys. Those artifacts frequently create noise during internal assessments and are usually less useful for host-to-host lateral mo.

Design goals

How it works

CredsHunter uses a fi funnel that narrows from known credential locations to recursi inspection.

| Stage | Focus | Examples |
|:--:|---|---|
| 1 | OS & application credential stores | Registry, GPP, histories, , keys, sa, known credential locations |
| 2 | Confirmed credential containers | .kdbx, .ppk, .pfx, .p12, .keytab, keystores and similar containers |
| 3 | High-value file types | Private keys, .env, backups, databases, captures, archives, configuration files |
| 4 | Suspicious filenames | *password*, *secret*, *credential*, *login*, *account* |
| 5 | Content scan | 70+ tuned credential regexes with false-positi |

Stages 1 and 5 perform the deepest inspection. Stages 2–4 are intentionally fast filename and extension passes.

Each finding is filtered before it reaches the final results, and findings are surfaced as the scan progresses rather than being hidden until the end.

---

Quick start

Linux

Windows

> Elevated execution is recommended when you want access to protected credential locations such as SAM / SYSTEM hives, vault directories, or other pri stores.

---

Usage

Linux

Full host sweep with findings written to a file:

Scan selected locations only:

Targeted scan without the slower recursi stage:

Exclude a directory tree:

Windows

Full C:\ sweep:

Scan multiple locations:

Web / database host with SQL and CS data scanning enabled:

Disable built-in system / exclusions:

CredsHunter is pipe-friendly. Use --no-color on Linux or -NoColor on Windows when redirecting or filtering output.

---

Finding tiers

Results are grouped by usefulness and confidence, with the most important findings shown first.

| Tag | Meaning |
|---|---|
| [CRITICAL] | Confirmed credential container |
| [HIGH] | Reusable password, hash, GPP cpassword, or equi credential material |
| [KEY] | Private key or other key material, including readable SAM / SYSTEM hi |
| [INTEREST] | High-value file or location worth manual review |
| [NAME] | Suspicious filename — useful as a review hint |

A sensiti in CRITICAL, HIGH, or KEY causes a non-zero sensiti exit status. INTEREST and NAME findings alone do not.

For example:

---

Scan controls

| Goal | Linux | Windows |
|---|---|---|
| Add scan paths | -p PATH / --path PATH | -Path PATH |
| Exclude paths | -x PATH / --exclude PATH | -ExcludePath PATH |
| Scan every readable text file in Stage 5 | -a / --all | -All |
| Change file-size cap | -m N / --max-size N | -MaxFileSizeMB N |
| Disable size cap | --no-size-limit | -NoSizeLimit |
| Write findings to file | -o FILE / --output FILE | -OutputFile FILE |
| Skip OS-le | -s / --skip-system / --no-stage1 | -SkipSystem / -NoStage1 |
| Skip a stage | --no-stage2 ... --no-stage5 | -NoStage2 ... -NoStage5 |
| Reduce status output | -q / --quiet | -Quiet |
| Disable ANSI colors | --no-color | -NoColor |
| Include SQL / CS data files | — | -IncludeData |
| Disable default /system exclusions | — | -NoDefaultExclude |

The default maximum file size is 5 MB. Increase it when credentials may live in larger logs, dumps, or configuration exports, or disable the cap when appropriate.

---

Customization

The pattern libraries and file-type lists are intentionally kept in clearly labeled configuration arrays inside each script.

You can extend or trim:

Edit the relevant list in one place; the scanning workflow does not need to be rewritten.

---

Requirements

| Platform | Requirements |
|---|---|
| Linux | Bash 4+, find, grep, awk, sed, stat |
| Linux — optional | realpath, file |
| Windows | PowerShell 5.1+ |
| Pri | Elevated execution is optional, but increases into protected credential locations |

The Linux implementation is designed for common distributions including Debian/Ubuntu, RHEL-family systems, Arch, and Alpine.

---

FAQ

<details>
<summary><strong>Does CredsHunter change anything on the host?</strong></summary>
<br>

No. The scanner is read-only. It writes only to the output file you explicitly choose, does not transmit findings over the network, and cleans up its temporary working data on exit.

</details>

<details>
<summary><strong>Why are AWS, GitHub, Slack, JWT, and generic API tokens ignored?</strong></summary>
<br>

By design. CredsHunter is optimized for credentials that are useful for local pri escalation and in-network lateral mo. Cloud and SaaS tokens are a major source of false-positi during this type of assessment.

Local cloud-CLI credential files and locations may still be surfaced for review; the tool simply avoids treating generic cloud/SaaS token patterns as primary reusable-credential findings.

</details>

<details>
<summary><strong>Stage 5 is slow. How can I speed it up?</strong></summary>
<br>

Narrow the scope with -p / -Path, exclude noisy trees, keep the default file-size limit, or skip the recursi scan with --no-stage5 / -NoStage5.

</details>

<details>
<summary><strong>A credential was missed. What should I check?</strong></summary>
<br>

Confirm that the target file:

1. Is inside the selected scan path.
2. Is not inside an excluded path.
3. Is below the configured size limit.
4. Uses an extension included in Stage 5.

For a broader check, use -a / --all on Linux or -All on Windows.

</details>

---

Wiki

For deeper project documentation, usage notes, and additional information, visit the Credential-Hunting Wiki.

---

Contributing

Contributions are welcome.

If you have a useful credential pattern, a false-positi, a platform-specific credential location, or an impro to scan performance and output quality, feel free to open an issue or pull request.

---

Responsible use

CredsHunter is intended for authorized security testing, internal penetration testing, red-team engagements, labs, and CTF en.

Only run it on systems you own or ha permission to assess.

<di="center">
_{Read-only. Network-silent. Built for signal o.}
</div>

项目信息

开发语言：PowerShell

Star 数：184

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CredsHunter - Credential Hunting scripts for Windows and Linux OS展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。