Sensitive information may include, but is not limited to:
-
Usernames.
-
Email Addresses.
-
Passwords.
-
DNS records.
-
IP Addresses.
-
Source code.
-
Configuration files.
-
PII. This module will cover some common services where we can find interesting information and discover different methods and tools we can use to automate our discovery process. These services include:
-
File Shares.
-
Email.
-
Databases.
There are two key elements to finding sensitive information:
- We need to understand the service and how it works.
- We need to know what we are looking for.