> For the complete documentation index, see [llms.txt](https://pwc-3.gitbook.io/pwc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwc-3.gitbook.io/pwc/ji-shu/untitled-1/offensive-security/credential-access-and-dumping.md).

# Credential Access & Dumping

Here are the articles in this section:[Dumping Credentials from Lsass Process Memory with MimikatzLocal Security Authority (LSA) credential dumping with in-memory Mimikatz using powershell.](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-credentials-from-lsass.exe-process-memory)[Dumping Lsass Without Mimikatz](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz)[Dumping Lsass without Mimikatz with MiniDumpWriteDumpEvasion, Credential Dumping](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass)[Dumping Hashes from SAM via RegistrySecurity Accounts Manager (SAM) credential dumping with living off the land binary.](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry)[Dumping SAM via esentutl.exe](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-sam-via-esentutl.exe)[Dumping LSA Secrets](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets)[Dumping and Cracking mscash - Cached Domain Credentials](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials)[Dumping Domain Controller Hashes Locally and RemotelyDumping NTDS.dit with Active Directory users hashes](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration)[Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-domain-controller-hashes-via-wmic-and-shadow-copy-using-vssadmin)[Network vs Interactive LogonsThis lab explores/compares when credentials are susceptible to credential dumping.](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/network-vs-interactive-logons)[Reading DPAPI Encrypted Secrets with Mimikatz and C++](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/reading-dpapi-encrypted-secrets-with-mimikatz-and-c++)[Credentials in RegistryInternal recon, hunting for passwords in Windows registry](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/t1214-credentials-in-registry)[Password FilterCredential Access](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/t1174-password-filter-dll)[Forcing WDigest to Store Credentials in Plaintext](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/forcing-wdigest-to-store-credentials-in-plaintext)[Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching Lsass](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-delegated-default-kerberos-and-ntlm-credentials-without-touching-lsass)[Intercepting Logon Credentials via Custom Security Support Provider and Authentication PackagesCredential Access, Persistence](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package)[Pulling Web Application Passwords by Hooking HTML Input FieldsCredential Access, Keylogger](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/stealing-web-application-credentials-by-hooking-input-fields)[Intercepting Logon Credentials by Hooking msv1\_0!SpAcceptCredentialsHooking, Credential Stealing](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-by-hooking-msv1_0-spacceptcredentials)[Credentials Collection via CredUIPromptForCredentials](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/credentials-collection-via-creduipromptforcredentials)