Directory Services Internals (DSInternals) PowerShell Module and Framework

Dump ntds.dit really fast

A tool to generate a wordlist from the information present in LDAP, in order to crack passwords of domain accounts.

cracke-dit ("Cracked It") makes it easier to perform regular password audits against Active Directory environments.

Analyze secretsdump output and hashcat potfiles to find shared passwords and weak credentials in Active Directory

A tool to analyze Ntds.dit files once the NTLM and LM hashes have been cracked.

A python tool to generate an Excel file linking the list of cracked accounts and their LDAP attributes.

Patching Bloodhound CE for Owned and PtH Attacks

Having the NTLM and a cracked LM hash it is possible to get the original password by testing all the combinations of upper and lowercases. This is useful if a ntds.dit file has both NTLM and LM hashes

Cracking and bruteforce methodologies for the most common hashes, services and technologies

The Forensic Examiners Swiss Army Knife.

Dump user password hashes from Active Directory databases.

doNTreuse.sh is a simple Bash script for examining the extent of NT hash reuse from the result of Impacket's secretsdump.py.

Offensive forensic analysis framework in Rust — extract credentials, keys, and persistence from disk images and memory dumps. SAM, NTDS.dit, LSA, DPAPI, browser passwords, SSH keys, cloud credentials, LSASS minidumps. Raw, E01, VMDK with NTFS and ext4 support.

revealhashed is a streamlined utility to correlate ntds usernames, nt hashes, and cracked passwords in one view while cutting out time-consuming manual tasks.

NTDS.dit Güvenlik İhlallerinin Tespit Analizi

A command-line tool for searching NTDS.dit data

revealhashed is a streamlined utility to correlate ntds usernames, nt hashes, and cracked passwords in one view while cutting out time-consuming manual tasks.

VMKatz prebuilt binaries