competition-lsass-ticket-material

Name: competition-lsass-ticket-material
Availability: InStock
Author: xjtu-wang

Trace sandboxed credential artifacts and identify replayable ones.

4|Updated Apr 9, 2026

Search Tags:#credentials #sandbox #forensics #replay #kerberos #dpapi #lsass

Ready to run

npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-lsass-ticket-material

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: competition-lsass-ticket-material
Source: https://github.com/xjtu-wang/DigAgent/tree/main/.agents/skills/competition-lsass-ticket-material
Command: npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-lsass-ticket-material

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables safe, structured tracing of LSASS-resident secrets, Windows logon data, Kerberos ticket caches, DPAPI-backed material, and SSP artifacts within a sandboxed ctf workflow, helping teams prove replayability and pivot edges without leaking host controls.

Core Features & Use Cases

LSASS artifact tracing: Identify and map LSASS memory artifacts, tickets, and DPAPI/SSP material to concrete replay paths.
Replayability assessment: Distinguish which credential artifacts are replayable and how they could enable a pivot under sandbox constraints.
Sandboxed workflow alignment: Ensure all actions stay within the established $ctf-sandbox-orchestrator context and routing rules.

Quick Start

Activate the $ctf-sandbox-orchestrator context and invoke this skill to trace LSASS artifacts and identify replayable credentials.

Frequently Asked Questions about competition-lsass-ticket-material

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace LSASS memory artifacts for Kerberos tickets and DPAPI material in a sandbox?▼

Trace LSASS memory artifacts by invoking a sandboxed skill that maps Windows logon data, Kerberos ticket caches, and DPAPI/SSP material to concrete replay paths while restricting all actions to the designated sandbox context.

What is the best way to assess if extracted LSASS credentials are replayable for pivot opportunities?▼

Assess replayable credentials by distinguishing which LSASS-resident artifacts enable pivoting and mapping them to replay paths under established sandbox constraints, proving credential edges without leaking host controls.

Can I analyze LSASS secrets and SSP artifacts without modifying the host system?▼

Analyze LSASS secrets and SSP artifacts safely by restricting all tracing actions to a controlled sandbox context, refusing unsanctioned host modifications while providing auditable analysis of Windows logon data.

Does tracing LSASS Windows logon data require a specific sandbox environment setup?▼

Tracing LSASS Windows logon data requires activating a sandbox orchestrator context to ensure all credential analysis and Kerberos ticket tracing actions stay within established routing rules and safe boundaries.

Why do I need a sandbox orchestrator to extract DPAPI and Kerberos ticket material from LSASS?▼

A sandbox orchestrator is needed to ensure safe, auditable analysis of DPAPI and Kerberos ticket material by restricting actions to the designated context and preventing unsanctioned host modifications during credential tracing.

What limitations exist when tracing replayable credentials and LSASS secrets in a sandboxed workflow?▼

Limitations include restricting all LSASS secret tracing and replayable credential analysis strictly to the sandbox context, refusing any unsanctioned host modifications to ensure safe and auditable forensic investigation boundaries.