skills.rest
ArianHobson333
ArianHobson333COMMUNITY
Explore all skills by this author →
GitHub

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

7|1|Updated Apr 14, 2026
Search Tags:#SAM#hash cracking#password spraying#credential extraction#LSASS#DPAPI#NTLM relay
One-click install
npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill credential-access
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-access
Source: https://github.com/ArianHobson333/claude-bug-bounty-stack/tree/main/vendor/Decepticon/skills/post-exploit/credential-access
Command: npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill credential-access

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mimikatz, secretsdump.py, SharpDPAPI, Responder, ntlmrelayx.py, NetExec, DomainPasswordSpray, Hashcat, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides advanced techniques for extracting credentials from compromised systems and network traffic, enabling lateral movement and privilege escalation in security operations.

Core Features & Use Cases

  • Credential Extraction: Extracts credentials using LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, and password spraying.
  • LSASS Dumping: Offers multiple methods for extracting passwords from LSASS, including Mimikatz, nanodump, and comsvcs.dll.
  • SAM/SECURITY Hive Extraction: Provides both local and remote methods for extracting credentials from SAM, SYSTEM, and SECURITY hives.
  • DPAPI Secrets: Decrypts DPAPI-protected credentials for browsers and credential vaults.
  • NTLM Relay Attacks: Performs NTLM relay attacks using ntlmrelayx.py and PetitPotam for lateral movement.
  • Password Spraying: Implements password spraying using CrackMapExec and NetExec.
  • Offline Hash Cracking: Offers hash cracking capabilities using Hashcat for password recovery.

Quick Start

Extract credentials from LSASS memory using mimikatz and export them to a file.

Frequently Asked Questions about credential-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract credentials from LSASS memory during a penetration test?▼

LSASS dumping extracts passwords from memory using Mimikatz, nanodump, or comsvcs.dll. This Skill provides multiple methods for extracting credentials from compromised systems and exporting them to a file for lateral movement.

What's the best way to decrypt DPAPI-protected browser credentials and vaults?▼

DPAPI decryption unlocks protected credentials for browsers and credential vaults using SharpDPAPI. This Skill handles DPAPI secrets extraction to recover sensitive data from compromised systems during security operations.

Can I perform NTLM relay attacks using ntlmrelayx.py for lateral movement?▼

NTLM relay attacks are supported using ntlmrelayx.py and PetitPotam for lateral movement. This Skill enables credential access by relaying authentication across network traffic in penetration testing scenarios.

How do I extract passwords from SAM and SECURITY hives remotely?▼

SAM and SECURITY hive extraction provides both local and remote methods for extracting credentials. This Skill handles SAM, SYSTEM, and SECURITY hive parsing to recover password hashes from compromised hosts.

Do I need Hashcat and NetExec to perform password spraying and offline hash cracking?▼

Yes, Hashcat handles offline hash cracking for password recovery, while NetExec and DomainPasswordSpray implement password spraying. These dependencies are required for the Skill's credential access and extraction capabilities.

What are the limitations of password spraying compared to offline hash cracking?▼

Password spraying using NetExec tests single passwords across many accounts online, risking lockouts, whereas offline hash cracking with Hashcat recovers passwords from extracted hashes without network interaction. This Skill supports both approaches for different attack phases.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

Windows Privilege Escalation

Enumerate Windows privileges and misconfigurations to identify privilege escalation vectors.

Community
Advanced
Prohao42Prohao42
120

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

Community
Advanced
hypnguyen1209hypnguyen1209
338

active-directory-attack

Enumerate Active Directory components and map attack paths with BloodHound.

Community
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced