Windows Credential Harvesting
Locate and extract credentials cached on Windows systems through registry queries, file searches, shadow copies, and DPAPI decryption. Covers browser passwords, saved sessions, unattend files, and vault entries accessible without domain access.
Windows Credential Harvesting extracts locally stored credentials from compromised systems for authorized penetration testing.
AI-generated summary based on this skill's SKILL.md
Install
blacklanternsecurity/red-run/windows-credential-harvesting · repository language: Python
git clone https://github.com/blacklanternsecurity/red-run
cp -r red-run ~/.claude/skills/windows-credential-harvestinggenerated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
npx skillfed install blacklanternsecurity/red-run/windows-credential-harvestingFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is Windows Credential Harvesting used for?
Windows Credential Harvesting is a tool designed to locate and extract credentials cached on Windows systems through registry queries, file searches, shadow copies, and DPAPI decryption. It covers browser passwords, saved sessions, unattend files, and vault entries accessible without domain access.
How does Windows Credential Harvesting extract windows passwords?
Windows Credential Harvesting extracts passwords by querying the Windows registry, searching file systems for credential stores, accessing shadow copies, and decrypting DPAPI-protected data. It targets browser password managers, saved RDP sessions, unattend configuration files, and Windows Credential Manager vault entries.
What types of credentials can this tool harvest?
Windows Credential Harvesting can harvest browser-stored passwords, cached login sessions, credentials in unattend files, Windows Credential Manager vault entries, and authentication tokens. It accesses these without requiring domain administrator privileges.
Can Windows Credential Harvesting enable lateral movement?
Yes, Windows Credential Harvesting supports post-exploitation activities by extracting harvested credentials that enable privilege escalation and lateral movement across networked systems. The extracted credentials can be reused to access additional resources and accounts.
What is the license for Windows Credential Harvesting?
Windows Credential Harvesting is released under the GPL-3.0 license, which permits use, modification, and distribution under the terms of the GNU General Public License version 3.