credential-dumping

Tag: credential-dumping

Aug 28, 2026 Windows Post-Exploitation 1 min read

Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.

credential-dumping dpapi vault

Aug 26, 2026 Windows Post-Exploitation 1 min read

With the domain DPAPI backup key from a DC, you can decrypt any user's masterkeys and the browser, vault, and RDP secrets they protect, offline.

credential-dumping domain dpapi

Aug 26, 2026 Windows Post-Exploitation 1 min read

A signed rundll32 call into comsvcs.dll writes an LSASS minidump without dropping mimikatz, sidestepping name-based detections.

credential-dumping lolbin lsass