> For the complete documentation index, see [llms.txt](https://staphysec.gitbook.io/staphysec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://staphysec.gitbook.io/staphysec/tools/credentials-theft-win.md).

# Credentials Theft/ Win

## Credentials Theft 

* In an Active Directory environment, we can use a tool such as [Snaffler](https://github.com/SnaffCon/Snaffler) to crawl network share drives for interesting file extensions such as `.kdbx`, `.vmdk`, `.vdhx`, `.ppk`, etc
* We can search the file system or share drive(s) manually using the following commands from [this cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md#search-for-a-file-with-a-certain-filename).
* [DB Browser for SQLite](https://sqlitebrowser.org/dl/) open sqllite files for inspection.
* tool such as [SharpChrome](https://github.com/GhostPack/SharpDPAPI) to retrieve cookies and saved logins from Google Chrome.
* MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.).  [MailSniper](https://github.com/dafthack/MailSniper).
* [LaZagne](https://github.com/AlessandroZ/LaZagne) tool  (Credentials recovery project).
* [SessionGopher](https://github.com/Arvanaghi/SessionGopher) to extract saved PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP credentials.
* tool [net-creds](https://github.com/DanMcInerney/net-creds) to sniff passwords and hashes from a live interface or a pcap file.
* [Responder](https://github.com/lgandx/Responder) Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
* [Inveigh](https://github.com/Kevin-Robertson/Inveigh), or [InveighZero](https://github.com/Kevin-Robertson/InveighZero) .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers.