Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A DFIR practitioner details how threat actors harvest plaintext credentials on Linux systems, drawing from real-world incident investigations. Techniques covered include bash history leaking keystore passwords (leading to Azure tenant compromise), process memory extraction via truffleproc and ptrace, command-line snooping with pspy, backdoored login portals on Citrix NetScaler, SSH/sudo credential interception with 3snake, and PAM module abuse for keystroke logging. Each technique is paired with concrete hardening recommendations such as restricting ptrace scope, enforcing SSH key-only authentication, implementing file integrity monitoring on /etc/pam.d/, and using secrets managers instead of CLI arguments.
