Blog
Guides on SAM, SECURITY, LSA secrets, NTDS.dit and credential-theft investigations.
Beyond Impacket secretsdump: pypykatz, gosecretsdump, NetExec, Mimikatz, SharpSecDump, DSInternals and secretsdump.com — what each does and when to reach for it.
A quick reference for Impacket secretsdump.py: offline LOCAL dumping of SAM, SECURITY and NTDS.dit hives, plus remote, pass-the-hash, Kerberos and DCSync usage.
How secretsdump's -just-dc uses the DRSUAPI replication protocol to pull every domain hash from a DC without touching disk — the required rights, the flags, and what it outputs.
How to read Impacket secretsdump output — the username:RID:LMhash:NThash pwdump line, the blank LM hash, the DCC2 ($DCC2$) cache and the LSA secrets block.
From the hashed boot key to a user's NT hash: the F and V structures, the RC4 vs AES storage formats, and the per-RID DES layer that wraps every Windows password hash.
The boot key is the root of all offline credential dumping. Here is where it lives, why it is scrambled across four registry keys, and how to reassemble it from the SYSTEM hive.
A domain controller keeps every account hash in one ESE database. See how the datatable, the Password Encryption Key (PEK) and each cipher layer fit — and how a hash is unwrapped offline.
The SECURITY hive holds service passwords, the machine account, DPAPI keys and logon caches. See how the LSA key unlocks them — and why DCC2 is salted but still crackable.