gentilkiwi/mimikatz

Mimikatz is a Windows security research and testing tool originally created by security researcher Benjamin Delpy to learn the C programming language and experiment with how Windows handles authentication. It is now widely used in the security community for penetration testing, the practice of deliberately trying to break into a system in order to find vulnerabilities before attackers do. The tool works by reading credential data directly from Windows memory. When a Windows computer logs you in, it stores authentication tokens and sometimes even passwords in a part of memory managed by a process called LSASS (Local Security Authority Subsystem Service). Mimikatz can extract this data, including plaintext passwords, password hashes (scrambled versions of passwords), PIN codes, and Kerberos tickets (authentication tokens used in Windows networks). It can also perform attacks like pass-the-hash and pass-the-ticket, which let an attacker authenticate as a user without knowing their actual password, just by reusing the stored hash or ticket. A particularly powerful feature is creating "Golden Tickets," forged Kerberos authentication tokens that can grant long-lasting access to resources in a Windows domain network. Mimikatz is primarily used by security professionals to test whether a Windows environment is vulnerable to these credential theft techniques. Because it works against real Windows authentication mechanisms, it is also well known to attackers, making it a common tool in real-world intrusions as well. It is written in C and requires running with elevated (administrator-level) privileges. It is licensed under CC BY 4.0.