Directory Services Internals (DSInternals) PowerShell Module and Framework
Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.
Decrypt Chromium based browser passwords with PowerShell.
A C# tool to output crackable DPAPI hashes from user MasterKeys
Decrypt SCCM and DPAPI secrets with Powershell.
A collection of DPAPI hunting and parsing BOFs
Windows DPAPI JNA Wrapper
Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager
Extract DPAPI CREDHIST and Masterkey hashes
A DataProtect wrapper that uses DPAPI in Windows and AspNetCore.DataProtection in other platforms.
Utilities and files for SQL Server Management Studio 21 and 22
SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage
Python application to scan user's installed browsers for secrets such as stored passwords and cookies.
Console utility to view saved passwords in Chrome and export to .csv file (Windows)
To associate your repository with the dpapi topic, visit your repo's landing page and select "manage topics."