Directory Services Internals (DSInternals) PowerShell Module and Framework

Dumping DPAPI credz remotely

DPAPI looting remotely and locally in Python

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

Decrypt Chromium based browser passwords with PowerShell.

A C# tool to output crackable DPAPI hashes from user MasterKeys

Decrypt SCCM and DPAPI secrets with Powershell.

A collection of DPAPI hunting and parsing BOFs

GO Wrapper for Windows DPAPI

A sort of a toolkit to decrypt Dropbox Windows DBX files

Windows DPAPI JNA Wrapper

Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager

Extract DPAPI CREDHIST and Masterkey hashes

A DataProtect wrapper that uses DPAPI in Windows and AspNetCore.DataProtection in other platforms.

Utilities and files for SQL Server Management Studio 21 and 22

SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage

Python application to scan user's installed browsers for secrets such as stored passwords and cookies.

Console utility to view saved passwords in Chrome and export to .csv file (Windows)

Prebuilt native module (Node.JS) to encrypt data on Windows with DPAPI.