I still remember when Mimikatz dropped in 2011. It was a wild time in offensive security, and a period where a single tool could expose fundamental weaknesses in Windows credential handling and force the entire ecosystem to level up. Features like Protected Process Light (PPL), hardened LSASS protections, and vastly improved ETW telemetry didn’t emerge in a vacuum; they were, in part, Microsoft’s response to researchers openly demonstrating just how broken things were. It was an era defined by deep technical curiosity and creative problem-solving on both sides of the fence, and this was long before AI entered the chat., I still remember when Mimikatz dropped in 2011. It was a wild time in offensive security, and a period where a single tool could expose fundamental weaknesses in Windows credential handling and force the entire ecosystem to level up. Features like Protected Process Light (PPL), hardened LSASS protections, and vastly improved ETW telemetry didn’t emerge in a vacuum; they were, in part, Microsoft’s response to researchers openly demonstrating just how broken things were. It was an era defined by deep technical curiosity and creative problem-solving on both sides of the fence, and this was long before AI entered the chat.

Windows绕过EDR实现DumpHash. Contribute to AabyssZG/HashDump-BypassEDR development by creating an account on GitHub.

KslDump — Why bring your own knife when Defender already left one in the kitchen? - andreisss/KslDump

PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping - BlackSnufkin/CredsHunter

A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory. - dazzyddos/lsawhisper-bof

Tool to remotely dump secrets from the Windows registry - jfjallid/go-secdump

Combining KslDump and GhostKatz to dump LSASS using no-fix KslD.sys memory read to bypass PPL. Extracts MSV1_0 NT hashes and WDigest cleartext passwords (if enabled) from LSASS using a Microsoft-signed driver. - k3nundrum/KslKatz

In-memory BOF implementation of Silent Process Exit LSASS dump via RtlReportSilentProcessExit - kimd155/WerWolf

LSASS Credential Dumper that utilizes the Windows API, in-memory RC4 encryption and Base64 encoding, and HTTPS exfiltration. - Meowmycks/catdumper

A sophisticated, covert Windows-based credential dumper using C++ and MASM x64. - Meowmycks/LetMeowIn

Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory. - GitHub - Offensive-Panda/ShadowDumper: Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory.

Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!) - ricardojoserf/NativeDump

Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority (LSA) cache. Like finding a ticket, but for security research and penetration testing! 🎫 - Shac0x/Wonka

🔥📜 Forbidden collection of Red Team sorcery 📜🔥. Contribute to vari-sh/RedTeamGrimoire development by creating an account on GitHub.

The different ways to dump lsass. Contribute to yo-yo-yo-jbo/dumping_lsass development by creating an account on GitHub.

Learn how attackers dump credentials from Local Security Authority (LSASS.exe) and how to prevent such attacks in your Windows environment.

A community database of attack prerequisites — the conditions attackers cannot avoid regardless of tool choice. Each chokepoint includes Sigma detection rule..., A community database of attack prerequisites — the conditions attackers cannot avoid regardless of tool choice. Each chokepoint includes Sigma detection rules at Research, Hunt, and Analyst maturity levels.

Microsoft introduced Credential Guard in Windows 10 (2015) and Windows Server 2016 to prevent credential harvesting from the LSASS process that was abused for years by threat actors. Microsoft used Virtualization Based Security (VBS) to isolate and protect credentials from the rest of the operating system. Credential material is stored in a protected environment to…

Fixing Mimikatz sekurlsa::logonpasswords on Windows 11 24H2/25H2 From “Logon list” error to working NTLM extraction. Special thanks for their work on the case @adrvs42 and @enessakircolak. You …

Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.

Learn how Nemesis 2.2 automates Windows DPAPI abuse for offensive operations, including SYSTEM and user masterkey decryption, DPAPI blob carving, and full Chromium App-Bound Encryption (ABE) cookie and login data extraction - covering everything from registry hive parsing to CNG key handling.

Understanding LSASS internals, Kerberos ticket storage, and how Windows manages logon sessions in memory.

Use the offensive tool WSASS to dump the LSASS memory area by exploiting the vulnerability in WerFaultSecure.exe