Credential Operations
Overview
Credential operations cover the full lifecycle of credential harvesting and cracking after gaining access: extracting credentials from compromised systems (files, memory, registry), cracking password hashes offline, performing online brute-force attacks, and password spraying across networks. Credentials are the key to lateral movement — cracked hashes and harvested passwords unlock access to additional systems, services, and ultimately domain admin.
Topics in This Section
- Linux Credential Harvesting
- Windows Credential Harvesting
- Hash Cracking
- Online Attacks
- Password Spraying
General Approach
- Harvest — extract credentials from the compromised system (files, memory, databases, registry)
- Identify — determine hash types and which services they authenticate to
- Crack offline — use hashcat or john against wordlists and rules
- Spray — test discovered passwords against other accounts and services
- Pivot — use cracked credentials for lateral movement