skills.rest
xjtu-wang
xjtu-wangCOMMUNITY
Explore all skills by this author →
GitHub

competition-lsass-ticket-material

Trace sandboxed credential artifacts and identify replayable ones.

4|Updated Apr 9, 2026
Search Tags:#credentials#sandbox#forensics#replay#kerberos#dpapi#lsass
One-click install
npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-lsass-ticket-material
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-lsass-ticket-material
Source: https://github.com/xjtu-wang/DigAgent/tree/main/.agents/skills/competition-lsass-ticket-material
Command: npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-lsass-ticket-material

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables safe, structured tracing of LSASS-resident secrets, Windows logon data, Kerberos ticket caches, DPAPI-backed material, and SSP artifacts within a sandboxed ctf workflow, helping teams prove replayability and pivot edges without leaking host controls.

Core Features & Use Cases

  • LSASS artifact tracing: Identify and map LSASS memory artifacts, tickets, and DPAPI/SSP material to concrete replay paths.
  • Replayability assessment: Distinguish which credential artifacts are replayable and how they could enable a pivot under sandbox constraints.
  • Sandboxed workflow alignment: Ensure all actions stay within the established $ctf-sandbox-orchestrator context and routing rules.

Quick Start

Activate the $ctf-sandbox-orchestrator context and invoke this skill to trace LSASS artifacts and identify replayable credentials.

Frequently Asked Questions about competition-lsass-ticket-material

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace LSASS memory artifacts for Kerberos tickets and DPAPI material in a sandbox?▼

Trace LSASS memory artifacts by invoking a sandboxed skill that maps Windows logon data, Kerberos ticket caches, and DPAPI/SSP material to concrete replay paths while restricting all actions to the designated sandbox context.

What is the best way to assess if extracted LSASS credentials are replayable for pivot opportunities?▼

Assess replayable credentials by distinguishing which LSASS-resident artifacts enable pivoting and mapping them to replay paths under established sandbox constraints, proving credential edges without leaking host controls.

Can I analyze LSASS secrets and SSP artifacts without modifying the host system?▼

Analyze LSASS secrets and SSP artifacts safely by restricting all tracing actions to a controlled sandbox context, refusing unsanctioned host modifications while providing auditable analysis of Windows logon data.

Does tracing LSASS Windows logon data require a specific sandbox environment setup?▼

Tracing LSASS Windows logon data requires activating a sandbox orchestrator context to ensure all credential analysis and Kerberos ticket tracing actions stay within established routing rules and safe boundaries.

Why do I need a sandbox orchestrator to extract DPAPI and Kerberos ticket material from LSASS?▼

A sandbox orchestrator is needed to ensure safe, auditable analysis of DPAPI and Kerberos ticket material by restricting actions to the designated context and preventing unsanctioned host modifications during credential tracing.

What limitations exist when tracing replayable credentials and LSASS secrets in a sandboxed workflow?▼

Limitations include restricting all LSASS secret tracing and replayable credential analysis strictly to the sandbox context, refusing any unsanctioned host modifications to ensure safe and auditable forensic investigation boundaries.

Related Skills

Explore More Software Engineering Skills→
xjtu-wangxjtu-wang
4

competition-crypto-mobile

Reconstruct cryptographic transform chains and inspect mobile signing paths in CTF sandboxes.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-linux-credential-pivot

Trace Linux credential artifacts and host-to-host pivot chains in sandboxed environments.

Community
Advanced
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced