gentilkiwi/mimikatz

Features

• Credential Extraction Toolkits - A toolkit for auditing Windows security by accessing sensitive data stored in the Local Security Authority Subsystem Service.
• Credential Auditing Tools - Extracting and analyzing authentication secrets from system memory to evaluate the security posture of Windows user accounts.
• Session and Credential Management - Extracts stored passwords, hashes, and authentication keys from system memory for active user sessions.
• Credential Extraction Utilities - Extracts authentication secrets and password hashes from the Local Security Authority and local security account databases.
• Kerberos Authentication - Features a specialized toolkit for inspecting, forging, and injecting Kerberos authentication tickets.
• Kerberos Security Testers - Managing, forging, and injecting authentication tickets to test the resilience of network identity and access control systems.
• Ticket Forgery Tools - Constructs and injects forged authentication tickets into memory to simulate valid user identities within a networked domain environment.
• Memory Inspection Tools - Reads and modifies the memory space of privileged system processes to extract sensitive authentication data and security tokens.
• Kerberos Ticket Forgers - Generates custom authentication tickets with arbitrary data to impersonate identities within a network.
• Security Token Manipulators - Elevating process privileges and impersonating user sessions to verify access control boundaries and identify potential privilege escalation paths.
• Session Impersonators - Impersonates user sessions by executing processes with captured authentication hashes or keys.
• Security Testing and Auditing - Extracts authentication credentials and security secrets from system memory to audit Windows security posture.
• Process Injection Frameworks - Injects custom code modules into active system processes to intercept authentication flows and manipulate security service behavior.
• API Hooking Utilities - Hooks low-level operating system functions to monitor or alter security-sensitive operations performed by the kernel and background services.
• Windows Administration Utilities - Executing privileged commands and managing system services to perform maintenance, configuration, and security testing on local machines.
• Authentication Hooking Utilities - Hooks into authentication processes to capture credentials or bypass security checks by modifying memory structures.
• Certificate Management Utilities - Provides utilities for managing, exporting, and auditing digital certificates within Windows certificate stores.
• Hooking Utilities - Intercepts calls to system security libraries to bypass export restrictions and extract protected keys from hardware or software vaults.
• Kerberos Ticket Inspectors - Inspects and displays metadata for active Kerberos authentication tickets to verify identity security.
• Kerberos Ticket Extractors - Extracts and saves active Kerberos tickets from memory for use in subsequent authentication operations.
• Kerberos Ticket Injectors - Loads existing Kerberos tickets into the current session memory to enable authentication as the associated user.
• Privilege Escalation Tools - Manipulates process tokens and system services to evaluate and perform privilege escalation.
• Process Token Manipulators - Provides capabilities to manipulate process security tokens to elevate privileges and impersonate user contexts.
• Exploit Development - Tool for Windows security auditing and credential extraction.
• Active Directory Exploitation - Utility for credential dumping, token manipulation, and Windows security bypasses.
• Active Directory Tools - Tool for credential extraction and post-exploitation in Windows environments.
• Credential Access - Extracts hashed and cleartext passwords from system memory.
• Credential and Access Tools - Comprehensive post-exploitation tool for credential dumping and security testing.
• Credential Collection - Standard tool for Windows credential extraction and manipulation.
• Credential Dumping - Extracts authentication credentials and Kerberos tickets from memory.
• Credential Harvesting - Extracts credentials from Windows memory.
• Execution and Persistence - Extracts credentials and performs Windows post-exploitation.
• Offensive Security Frameworks - Extracts credentials and performs advanced Kerberos and hash-based attacks.
• Password Attacks - Advanced tool for credential dumping and Windows security manipulation.
• Security Tooling - Utility for extracting credentials and manipulating Kerberos tickets.
• Security Tools - Tool for exploring and testing Windows security.
• Cryptographic Asset - Extracts certificates and private keys from system stores or providers into portable file formats to facilitate backup, migration, or analysis.
• Cryptographic Asset Management - Exporting, importing, and auditing digital certificates and private keys stored within system vaults or hardware security modules.
• Memory Dump Parsers - Analyzes static snapshots of system memory to recover credentials and security secrets without requiring an active live connection.
• Client Certificate Generators - Generates client certificates for smartcard authentication by signing them with a specified certificate authority to ensure secure identity verification.
• Certificate Management Systems - Manages, imports, and exports digital certificates and private keys stored within system or hardware vaults.
• Cryptographic Key Extractors - Patches system cryptographic services to allow the extraction of keys marked as non-exportable.
• Elevation Mechanisms - Requests system-level permissions for processes to enable interaction with restricted services.
• Security Support Providers - Injects custom security modules into system memory to intercept and manipulate authentication processes at runtime.
• Credential Relay Tools - Injects captured hashes or tickets into active sessions to impersonate users and bypass authentication.
• Certificate Store Auditors - Lists logical certificate stores and their contents across various system and user-level storage locations to audit and organize digital identity assets.
• Purging Utilities - The tool removes all Kerberos tickets from the current session to clear the authentication state and force the system to re-authenticate for network requests.
• Smartcard Token Analyzers - Lists connected smartcard readers and identifies cryptographic keys stored on inserted tokens to verify hardware availability and access to authentication materials.
• Memory Dump Parsers - Parses offline memory dump files to perform credential extraction without requiring a live system connection.
• Directory Replication Tools - Requests account information from domain controllers by mimicking directory replication protocols.
• Security Identifier Modifiers - Modifies security identifiers on user accounts to test and alter access permissions and group memberships.
• Administrative Command Engines - Executes system-level instructions through a command-line interface to interact with background processes, manage services, and handle sensitive security tokens.

Star history