skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-credential-access-with-lazagne

Extract stored credentials from compromised endpoints using LaZagne during authorized red team operations.

954|172|Updated Mar 13, 2026
Search Tags:#post-exploitation#lateral movement#Red Team#mitre att&ck#credential dumping#password recovery#lazagne
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-credential-access-with-lazagne
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-credential-access-with-lazagne
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/performing-credential-access-with-lazagne
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-credential-access-with-lazagne

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests and red team engagements, operators need a structured way to recover credentials stored on compromised endpoints so they can validate lateral movement paths and demonstrate real business impact instead of theoretical risk.

Core Features & Use Cases

  • Multi-Platform Credential Extraction: Run LaZagne modules on Windows, Linux, and macOS to recover passwords from browsers, email clients, databases, Wi-Fi profiles, Git stores, and system vaults.
  • Privilege-Aware Workflow: Guidance on running modules as a standard user versus elevated SYSTEM/admin contexts to avoid false negatives from DPAPI, LSA secrets, and Credential Manager.
  • Credential Validation and Prioritization: Parse JSON output, deduplicate results, and validate recovered credentials with CrackMapExec or Impacket against AD/SMB targets.
  • Use Case: After gaining initial access to a Windows workstation, an operator runs lazagne.exe all -oJ, recovers a domain service account from WinSCP stored sessions, validates it with CrackMapExec, and uses it for lateral movement along a BloodHound attack path.

Quick Start

Ask the AI to walk you through deploying LaZagne on a compromised Windows host, running all modules with JSON output, and validating any recovered domain credentials against SMB.

Frequently Asked Questions about performing-credential-access-with-lazagne

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract all stored credentials with LaZagne?▼

Run lazagne.exe all on Windows or python3 laZagne.py all on Linux to execute every module, and add -oJ -output <path> to export results as JSON. Run once as the user and again with SYSTEM/admin privileges to cover DPAPI, LSA secrets, and Credential Manager.

What credentials can LaZagne recover from Windows systems?▼

LaZagne recovers passwords from browsers like Chrome, Firefox, and Edge, email clients like Outlook and Thunderbird, databases, Wi-Fi profiles, Git credential stores, PuTTY, WinSCP, FileZilla, Windows Credential Manager, Vault, and autologon entries.

Why does LaZagne return no credentials on a compromised host?▼

A standard-user run cannot access DPAPI master keys, LSA secrets, or SAM, producing false negatives. Re-run elevated as SYSTEM, ensure all browser profile paths are reachable, and confirm the wifi, sysadmin, and databases modules actually executed.

LaZagne vs Mimikatz for credential dumping, which should I use?▼

LaZagne covers stored credentials in files, browsers, and vaults, while Mimikatz extracts LSASS memory-resident secrets like cached logons. Use both together, since LaZagne alone misses in-memory credentials and Mimikatz alone misses browser and application stores.

How do I validate credentials recovered with LaZagne?▼

Test recovered domain credentials with crackmapexec smb <range> -u <user> -p '<pass>' and look for Pwn3d! or [+] responses, or use Impacket's smbclient.py. Cross-reference validated accounts with BloodHound to identify high-value lateral movement paths.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

c2

Establish framework-agnostic C2 infrastructure with HTTPS, DNS, mTLS, and WireGuard channels.

Community
Advanced
starwreckntxstarwreckntx

Lateral Movement Agent

Simulate lateral movement across enterprise networks using credential reuse and remote execution.

Community
Basic
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
blacklanternsecurityblacklanternsecurity
253

windows-credential-harvesting

Extract saved passwords and DPAPI-protected secrets from Windows systems.

Official
Advanced