Directory Services Internals (DSInternals) PowerShell Module and Framework

Dumping DPAPI credz remotely

DPAPI looting remotely and locally in Python

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

A C# tool to output crackable DPAPI hashes from user MasterKeys

Decrypt Chromium based browser passwords with PowerShell.

Decrypt SCCM and DPAPI secrets with Powershell.

No description provided.

A collection of DPAPI hunting and parsing BOFs

GO Wrapper for Windows DPAPI

A sort of a toolkit to decrypt Dropbox Windows DBX files

Windows DPAPI JNA Wrapper

Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager

A DataProtect wrapper that uses DPAPI in Windows and AspNetCore.DataProtection in other platforms.

Utilities and files for SQL Server Management Studio 21 and 22

Python application to scan user's installed browsers for secrets such as stored passwords and cookies.

Prebuilt native module (Node.JS) to encrypt data on Windows with DPAPI.

Console utility to view saved passwords in Chrome and export to .csv file (Windows)

Base class for saving, encrypting, and loading application settings in a Json file

Extract stored password(s) and important file(s) from various browser (i.e. Chrome, Brave, Edge, Opera)

Cross-platform PowerShell module that makes encrypting and decrypting strings (using standard cryptographic algorithms) and managing certificates easy.

A .Net Core Data Protection provider to persist keys to Sql Server

Ping Monitor

Information stored in applications is decrypted using DPAPI. In this way, attacker passwords may be captured. For use in attack scenarios, two applications written in Python language have been developed that steal the information stored in internet browsers: 1-Browser Stealer, 2-Browser Stealer Report

PrySec - Privacy & Security framework for your .NET applications

No description provided.

This attempts to reproduce/trigger an issue with the (classic) DPAPI being in an amnesic state on Windows 10/11 (credhist never gets updated, but master keys get re-generated)

A Golang-based tool for extracting and decrypting cookies from Chromium-based browsers using DPAPI.

Keytar in VS Code extension experiment

🔍 Extract and decrypt sensitive browser data from Chrome, Edge, and Brave on Windows, streamlining access to passwords and autofill information.