DonPAPI
Harvests and decrypts DPAPI secrets remotely and at scale.
Remotely harvests and decrypts DPAPI-protected secrets at scale (saved credentials, browser cookies, Wi-Fi profiles, the vault) across one or many domain hosts.
Family Credential dumping & theft
Flags collect -t -u -p -H
Concepts DPAPI Secrets, Credential Hunting
Cheatsheet Credentials & run-as
Installation
pipx install donpapiUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.