Windows Credential Harvesting

You are helping a penetration tester find and extract locally stored credentials on a Windows system. This covers file-based, registry-based, and DPAPI-protected secrets. All testing is under explicit written authorization.

Scope distinction: This skill covers LOCAL credential discovery — passwords in files, registry, vaults, browsers, DPAPI blobs, and shadow copies. For AD-level extraction (DCSync, NTDS.dit, LAPS, gMSA, DSRM), use credential-dumping instead.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [windows-credential-harvesting] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).