Systems and methods for discovering configuration data are disclosed. In accordance with one method, network configuration tokens for a system are identified. Further, potential configuration files are obtained by identifying running processes in the system, restarting the processes and monitoring the restarted processes to discover files opened by the restarted processes. In addition, files that include the identified network configuration tokens are selected from the potential configuration files. Moreover, the method includes determining, by a hardware processor, that a given token from the identified tokens is a true token by replacing the given token with a test token in at least one of the selected files, restarting the identified processes that read the given token, and identifying a change in at least one of system call activity or network activity in the system.