# gentilkiwi/mimikatz

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/gentilkiwi-mimikatz).**

21,274 stars · 4,032 forks · C

## Links

- GitHub: https://github.com/gentilkiwi/mimikatz
- Homepage: http://blog.gentilkiwi.com/mimikatz
- awesome-repositories: https://awesome-repositories.com/repository/gentilkiwi-mimikatz.md

## Description

Mimikatz is a security research suite designed for auditing Windows authentication and managing system security configurations. It provides a comprehensive framework for extracting sensitive credentials, manipulating process privileges, and managing digital identity assets directly from system memory or offline memory dumps.

The project distinguishes itself through advanced system-level exploitation techniques, including runtime process injection, API hooking, and the ability to bypass cryptographic export restrictions. It features a specialized toolkit for Kerberos protocol operations, allowing for the inspection, forgery, and injection of authentication tickets to evaluate network identity security. Additionally, it supports the extraction of authentication secrets from the Local Security Authority and the local security account database.

Beyond its core auditing capabilities, the suite includes utilities for managing system services, digital certificates, and cryptographic providers. It offers functionality for privilege escalation, user session impersonation, and the synchronization of data from domain controllers. The tool also provides observability features such as session logging, output encoding, and network route monitoring to assist in the analysis of administrative and security-related actions.

## Tags

### Security & Cryptography

- [Credential Extraction Toolkits](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/session-and-credential-handling/credential-security-utilities/credential-extraction-toolkits.md) — A toolkit for auditing Windows security by accessing sensitive data stored in the Local Security Authority Subsystem Service.
- [Credential Auditing Tools](https://awesome-repositories.com/f/security-cryptography/credential-auditing-tools.md) — Extracting and analyzing authentication secrets from system memory to evaluate the security posture of Windows user accounts.
- [Session and Credential Management](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/session-and-credential-handling/session-credential-management.md) — Extracts stored passwords, hashes, and authentication keys from system memory for active user sessions. ([source](https://github.com/gentilkiwi/mimikatz/wiki))
- [Credential Extraction Utilities](https://awesome-repositories.com/f/security-cryptography/identity-access-management/credential-lifecycle-management/credential-security/credential-extraction-utilities.md) — Extracts authentication secrets and password hashes from the Local Security Authority and local security account databases. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump))
- [Kerberos Authentication](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication.md) — Features a specialized toolkit for inspecting, forging, and injecting Kerberos authentication tickets.
- [Kerberos Security Testers](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-security-testers.md) — Managing, forging, and injecting authentication tickets to test the resilience of network identity and access control systems.
- [Ticket Forgery Tools](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/ticket-forgery-tools.md) — Constructs and injects forged authentication tickets into memory to simulate valid user identities within a networked domain environment.
- [Kerberos Ticket Forgers](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-ticket-forgers.md) — Generates custom authentication tickets with arbitrary data to impersonate identities within a network. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos))
- [Security Token Manipulators](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-tools/security-token-manipulators.md) — Elevating process privileges and impersonating user sessions to verify access control boundaries and identify potential privilege escalation paths.
- [Session Impersonators](https://awesome-repositories.com/f/security-cryptography/user-access-management/session-impersonators.md) — Impersonates user sessions by executing processes with captured authentication hashes or keys. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa))
- [Security Testing and Auditing](https://awesome-repositories.com/f/security-cryptography/vulnerability-assessment-testing/security-testing-auditing.md) — Extracts authentication credentials and security secrets from system memory to audit Windows security posture.
- [Authentication Hooking Utilities](https://awesome-repositories.com/f/security-cryptography/authentication-flows/authentication-hooking-utilities.md) — Hooks into authentication processes to capture credentials or bypass security checks by modifying memory structures. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-misc))
- [Certificate Management Utilities](https://awesome-repositories.com/f/security-cryptography/certificate-management-utilities.md) — Provides utilities for managing, exporting, and auditing digital certificates within Windows certificate stores.
- [Hooking Utilities](https://awesome-repositories.com/f/security-cryptography/cryptographic-providers/hooking-utilities.md) — Intercepts calls to system security libraries to bypass export restrictions and extract protected keys from hardware or software vaults.
- [Kerberos Ticket Inspectors](https://awesome-repositories.com/f/security-cryptography/identity-access-management/session-management/session-identifiers/session-lists/session-metadata-viewers/kerberos-ticket-inspectors.md) — Inspects and displays metadata for active Kerberos authentication tickets to verify identity security. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos))
- [Kerberos Ticket Extractors](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-ticket-extractors.md) — Extracts and saves active Kerberos tickets from memory for use in subsequent authentication operations. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa))
- [Kerberos Ticket Injectors](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-ticket-injectors.md) — Loads existing Kerberos tickets into the current session memory to enable authentication as the associated user. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos))
- [Privilege Escalation Tools](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-tools.md) — Manipulates process tokens and system services to evaluate and perform privilege escalation.
- [Process Token Manipulators](https://awesome-repositories.com/f/security-cryptography/security-token-management/process-token-manipulators.md) — Provides capabilities to manipulate process security tokens to elevate privileges and impersonate user contexts. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-token))
- [Client Certificate Generators](https://awesome-repositories.com/f/security-cryptography/certificate-authorities/client-certificate-generators.md) — Generates client certificates for smartcard authentication by signing them with a specified certificate authority to ensure secure identity verification. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-crypto))
- [Certificate Management Systems](https://awesome-repositories.com/f/security-cryptography/certificate-management-systems.md) — Manages, imports, and exports digital certificates and private keys stored within system or hardware vaults. ([source](https://github.com/gentilkiwi/mimikatz/wiki))
- [Cryptographic Key Extractors](https://awesome-repositories.com/f/security-cryptography/cryptographic-key-management/cryptographic-key-extractors.md) — Patches system cryptographic services to allow the extraction of keys marked as non-exportable. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-crypto))
- [Elevation Mechanisms](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/access-control-models/elevation-mechanisms.md) — Requests system-level permissions for processes to enable interaction with restricted services. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-privilege))
- [Security Support Providers](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/session-and-credential-handling/credential-security-utilities/security-support-providers.md) — Injects custom security modules into system memory to intercept and manipulate authentication processes at runtime. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-misc))
- [Credential Relay Tools](https://awesome-repositories.com/f/security-cryptography/security/infrastructure-and-hardware/infrastructure-system-hardening/active-directory-attacks/credential-relay-tools.md) — Injects captured hashes or tickets into active sessions to impersonate users and bypass authentication. ([source](https://github.com/gentilkiwi/mimikatz/wiki))
- [Certificate Store Auditors](https://awesome-repositories.com/f/security-cryptography/certificate-management-systems/certificate-store-auditors.md) — Lists logical certificate stores and their contents across various system and user-level storage locations to audit and organize digital identity assets. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-crypto))
- [Purging Utilities](https://awesome-repositories.com/f/security-cryptography/identity-access-management/session-management/session-identifiers/session-lists/session-metadata-viewers/kerberos-ticket-inspectors/purging-utilities.md) — The tool removes all Kerberos tickets from the current session to clear the authentication state and force the system to re-authenticate for network requests. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos))
- [Smartcard Token Analyzers](https://awesome-repositories.com/f/security-cryptography/token-based-authentication/smartcard-token-analyzers.md) — Lists connected smartcard readers and identifies cryptographic keys stored on inserted tokens to verify hardware availability and access to authentication materials. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-crypto))
- [Security Identifier Modifiers](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/access-control-models/permission-based-security/security-identifier-modifiers.md) — Modifies security identifiers on user accounts to test and alter access permissions and group memberships. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-misc))

### Operating Systems & Systems Programming

- [Memory Inspection Tools](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-inspection-tools.md) — Reads and modifies the memory space of privileged system processes to extract sensitive authentication data and security tokens.
- [Process Injection Frameworks](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management/process-lifecycle-orchestrators/process-injection-wrappers/process-injection-frameworks.md) — Injects custom code modules into active system processes to intercept authentication flows and manipulate security service behavior.
- [API Hooking Utilities](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-calls/api-hooking-utilities.md) — Hooks low-level operating system functions to monitor or alter security-sensitive operations performed by the kernel and background services.
- [Windows Administration Utilities](https://awesome-repositories.com/f/operating-systems-systems-programming/system-administration-maintenance/windows-administration-utilities.md) — Executing privileged commands and managing system services to perform maintenance, configuration, and security testing on local machines.
- [Memory Dump Parsers](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management-systems/memory-dump-parsers.md) — Analyzes static snapshots of system memory to recover credentials and security secrets without requiring an active live connection.

### Data & Databases

- [Cryptographic Asset](https://awesome-repositories.com/f/data-databases/asset-inventory-management/exporters/cryptographic-asset.md) — Extracts certificates and private keys from system stores or providers into portable file formats to facilitate backup, migration, or analysis. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-crypto))

### Networking & Communication

- [Cryptographic Asset Management](https://awesome-repositories.com/f/networking-communication/distributed-systems-p2p/decentralized-blockchain-technologies/blockchain-integration/cryptographic-asset-management.md) — Exporting, importing, and auditing digital certificates and private keys stored within system vaults or hardware security modules.

### Software Engineering & Architecture

- [Memory Dump Parsers](https://awesome-repositories.com/f/software-engineering-architecture/in-memory-code-analysis/memory-dump-parsers.md) — Parses offline memory dump files to perform credential extraction without requiring a live system connection. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa))

### System Administration & Monitoring

- [Directory Replication Tools](https://awesome-repositories.com/f/system-administration-monitoring/access-control-synchronizers/directory-replication-tools.md) — Requests account information from domain controllers by mimicking directory replication protocols. ([source](https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump))
- [Administrative Command Engines](https://awesome-repositories.com/f/system-administration-monitoring/command-execution-engines/administrative-command-engines.md) — Executes system-level instructions through a command-line interface to interact with background processes, manage services, and handle sensitive security tokens. ([source](https://github.com/gentilkiwi/mimikatz/wiki))