Skill UI

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

This skill details how to abuse the Windows DPAPI (Data Protection API) to extract and decrypt sensitive secrets protected by the OS. It covers multiple scenarios: online decryption (using the target user's context), offline decryption (requiring passwords or NTLM hashes), and advanced domain-wide decryption via the DPAPI backup key. Essential for red-teaming and post-exploitation activities to harvest credentials, browser logins, and Wi-Fi passwords.

This specialized skill is designed for in-depth security and forensic analysis of Windows secrets protected by DPAPI. It maps the entire lifecycle of encrypted credentials, tracing the flow from the initial protected blob or masterkey through the context unwrapping (e.g., user logon, machine context, domain backup keys) to the specific service that finally accepts the plaintext secret. Use this to prove the decisive access edge in a complex compromise scenario.