> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/filesystem-search/trick-0017.md).

# Credentials Found via Locate

***

Hints found on a system, such as in login messages or unusual files, can point to hidden locations or filenames. Take keywords from these hints and use the `locate` command to quickly search the system's database for matching paths.

For instance, if a login message mentions "s3cr3t":

```bash
locate s3cr3t
```

This command will rapidly search the `locate` database and potentially reveal paths containing the keyword, leading you to sensitive files that might otherwise be hard to find.

The `locate` utility works better and faster than the `find` command counterpart because instead of searching the file system when a file search is initiated, it would look through a database. This database contains bits and parts of files and their corresponding paths on your system. By default, `locate` command does not check whether the files found in the database still exist and it never reports files created after the most recent update of the relevant database.

The basic syntax for the `locate` command is:

```bash
locate [OPTION]... PATTERN...
```

You can use several options to refine your searches:

**Ignoring Case Sensitivity**\
By default, `locate` processes queries in a case-sensitive manner (e.g., `SAMPLE.TXT` is different from `sample.txt`). To ignore case distinctions when matching patterns, use the `-i` option:

```bash
locate -i *SAMPLE.txt*
```

**Limiting Search Results**\
If you anticipate a large number of matches, you can limit the output to a specific number of entries using the `-n` (or `-l`, `–limit`) option. For example, to display only the first 20 files ending with `.html`:

```bash
locate "*.html" -n 20
```

**Displaying the Count of Matching Entries**\
Instead of listing the filenames, you can display only the number of matching entries using the `-c` (or `–count`) option. For example, to count files related to `.txt`:

```bash
locate -c [.txt]*
```

This will count files matching the pattern.

**Matching Only the Basename**\
The default behavior of `locate` is to match the pattern against the whole path name. If you want to match only the base name of the file (i.e., the filename itself, without the directory path), use the `-b` (or `–basename`) option.

**Ensuring Files Exist**\
Since `locate` relies on a database that might not be perfectly current, some search results might point to files that have been deleted or moved. To print only entries that refer to files existing at the time `locate` is run, use the `-e` (or `–existing`) option.

**Using NULL Character as Separator for Scripting**\
When piping `locate`'s output to other commands like `xargs`, it's often safer to use a NULL character as a separator instead of a newline. This can be done with the `-0` (or `–null`) option:

```bash
locate -i -0 *sample.txt*
```

The default separator for `locate` command is the newline () character. The `-0` option changes this to the ASCII NULL character, which is designed for interoperability with the `–null` option of GNU `xargs`.