windows-credential-harvesting

Extract saved passwords and DPAPI-protected secrets from Windows systems.

253|37|Updated Feb 22, 2026

Search Tags:#privilege escalation #windows #credential harvesting #mimikatz #dpapi #password hunting

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill windows-credential-harvesting

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: windows-credential-harvesting
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/privesc/windows-credential-harvesting
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill windows-credential-harvesting

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps security professionals discover and extract locally stored credentials on Windows systems, aiding in privilege escalation and lateral movement during authorized penetration tests.

Core Features & Use Cases

Local Credential Discovery: Finds saved passwords in browsers, registry, command history, and DPAPI-protected stores.
Exploitation Techniques: Leverages tools like Mimikatz, SharpDPAPI, and others to decrypt or extract sensitive information.
Use Case: During a penetration test, an analyst can use this Skill to find cached Wi-Fi passwords or saved browser credentials on a compromised Windows host to gain access to other systems or user accounts.

Quick Start

Run the windows-credential-harvesting skill to find saved Wi-Fi passwords on the target system.

Frequently Asked Questions about windows-credential-harvesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract saved passwords and browser data on a Windows system?▼

To extract saved passwords and browser data on a Windows system, this Skill locates and pulls locally stored credentials from browsers, command history, and registry. It leverages tools like SharpDPAPI and Mimikatz to uncover sensitive authentication data on compromised hosts.

What is DPAPI credential harvesting and when do I need it for privilege escalation?▼

DPAPI credential harvesting is the process of extracting Data Protection API-protected secrets to decrypt saved passwords on Windows. You need it for privilege escalation when local reconnaissance reveals cached credentials that can unlock access to other user accounts or systems.

Can I use Mimikatz and SharpDPAPI to find cached Wi-Fi passwords on Windows?▼

Yes, you can use Mimikatz and SharpDPAPI to find cached Wi-Fi passwords on Windows. The Skill utilizes these tools to extract and decrypt locally stored credentials, enabling analysts to recover network authentication data during authorized penetration tests.

What is the best way to perform local credential discovery for lateral movement?▼

The best way to perform local credential discovery for lateral movement is by scanning for locally stored credentials in registry, command history, and DPAPI-protected stores. This Skill automates extracting those secrets to facilitate further network access.

Does Windows credential extraction work without administrator privileges?▼

Windows credential extraction supports various privilege levels, but accessing certain DPAPI-protected secrets and utilizing tools like Mimikatz typically require elevated permissions. The Skill performs local system reconnaissance to extract what is accessible at the current privilege level.

What are the limitations of extracting DPAPI-protected secrets on compromised hosts?▼

Extracting DPAPI-protected secrets on compromised hosts is limited by the current user's privilege level and system protections. While the Skill leverages tools to decrypt saved browser data and passwords, certain system-level credentials remain inaccessible without elevated administrative rights.