Harvesting sensitive data is a core goal of post-exploitation. Once access to internal systems is established, attackers begin collecting information valuable to the organization or useful for further compromise. Sensitive data includes business documents, internal communications, credentials, personal information, logs, configuration files, and backups. This phase must be approached systematically to avoid noise, remain stealthy, and extract maximum intelligence from compromised environments.

Understanding What Counts as Sensitive Data

Sensitive data falls into several categories:

Authentication material (passwords, hashes, tokens, keys)
Personal data (PII, financial info, employee records)
Business files (documents, spreadsheets, contracts)
Server configs (database strings, API keys, cloud credentials)
Source code, repositories, secrets
Backups and archives
Email stores
Internal logs and monitoring data

Each category may provide escalation, persistence, or impact opportunities.

Step 1: Identify High-Value Locations

After pivoting into internal machines, start by identifying common storage paths.

Windows Common Locations

C:\Users\<user>\Desktop
C:\Users\<user>\Documents
C:\Users\Public
C:\ProgramData
C:\inetpub\wwwroot
C:\Backups

Linux Common Locations

/home
/var/www
/etc
/opt
/srv
/root

Search these locations for documents, notes, credentials, and configuration files.

Step 2: Search for Passwords and Secrets

Sensitive strings often appear in plain-text files.

Windows Search

findstr /spin /c:"password" C:\Users\*
findstr /spin /c:"key" C:\*
findstr /spin /c:"secret" C:\*

Linux Search

grep -Ri "password" /home /var/www /etc
grep -Ri "secret" /
grep -Ri "token" /

Look for:

.env files
config.php
YAML config files
PowerShell deployment scripts
Bash automation scripts

These often expose databases, AWS keys, or admin credentials.

Step 3: Extracting Browser Data

Browsers store cached data, cookies, and saved passwords.

Windows Browser Data

%LOCALAPPDATA%\Google\Chrome\User Data\Default\
%LOCALAPPDATA%\Microsoft\Edge\User Data\

Exporting cookies allows session hijacking:

copy Cookies C:\temp\cookies.db

Linux Browser Paths

~/.config/google-chrome
~/.mozilla/firefox

Cookies and history reveal internal app locations and tokens.

Step 4: Harvesting Email Data

Email often contains sensitive internal information.

Windows Outlook Files

C:\Users\<user>\AppData\Local\Microsoft\Outlook\

PST/OST files store:

Conversations
Passwords shared internally
HR data
Financial info
Internal alerts

Linux Mail Spools

/var/mail
/var/spool/mail

Emails often reveal passwords, API keys, and approval chains.

Step 5: Extracting Cloud Credentials

Cloud services rely heavily on credential files.

AWS Credentials

~/.aws/credentials

Azure CLI Tokens

~/.azure/

GCP Credentials

~/.config/gcloud/

Cloud credentials enable complete external compromise.

Step 6: Harvest Database Backups

Databases are frequently backed up on internal systems.

Common Backup File Types

.bak
.sql
.sql.gz
.dump
.tar
.zip

Extract credentials inside backups:

User tables
Configuration rows
Password hashes
Session tokens

Databases often hold the highest-value data.

Step 7: Extract Logs and Monitoring Data

Logs provide insights into:

User behavior
Authentication attempts
Internal IP mapping
Admin activity

Windows Logs

C:\Windows\System32\winevt\Logs

Linux Logs

/var/log

Assess logs for security gaps and lateral movement opportunities.

Step 8: Search for SSH Keys and Certificates

SSH keys can provide immediate access to additional systems.

Linux Key Paths

~/.ssh/id_rsa
~/.ssh/id_ed25519
/etc/ssh/ssh_host_rsa_key

Windows SSH (if installed)

C:\Users\<user>\.ssh\

Certificates found in:

C:\ProgramData\Microsoft\Crypto

Private keys enable direct authentication into servers.

Step 9: Harvest Source Code and Repositories

Source code contains:

API keys
Hardcoded credentials
Database strings
Developer notes
Build secrets

Common locations:

C:\Repos
C:\Projects
/home/dev/

Git repositories reveal commit history and removed secrets.

Step 10: Identify Backup and Sync Services

Backup folders contain everything needed for system reconstruction.

Windows Backup Paths

C:\Backups
D:\Backups
C:\Users\<user>\OneDrive

Linux Backup Locations

/mnt/backups
/opt/backup

Sync services like OneDrive, Google Drive, or Dropbox often sync internal documents.

Step 11: Harvesting Data from Network Shares

Use SMB to explore shared storage.

List Shares

proxychains smbclient -L //10.10.20.5 -U user

Connect and Browse

proxychains smbclient //10.10.20.5/share -U user