performing-credential-access-with-lazagne

name	performing-credential-access-with-lazagne
description	Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","credential-access","lazagne","post-exploitation","password-recovery","credential-dumping","lateral-movement"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Performing Credential Access with LaZagne

Overview

LaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.

When to Use

• When conducting security assessments that involve performing credential access with lazagne
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Most Often Missed & How to Confirm

• Run lazagne.exe all (every module), not just browsers — operators routinely skip windows (Credential Manager/Vault/LSA secrets/autologon), wifi, mails, databases, and sysadmin (PuTTY/WinSCP/FileZilla/OpenSSH), which is where the lateral-movement creds usually live.
• DPAPI master keys, LSA secrets, and autologon need SYSTEM/admin — run once as the user, then re-run elevated (lazagne.exe all under a SYSTEM token). A standard-user run that returns "nothing" is a false negative for system stores.
• Memory/LSASS-resident secrets aren't covered by LaZagne — pair with mimikatz sekurlsa::logonpasswords / lsadump::secrets; concluding "no creds" from LaZagne alone misses cached logons.
• Browser cookies/session tokens (T1539) are missed when only password fields are checked — grab them for session hijack even when no plaintext password exists.
• Always export with -oJ -output <path> so nothing scrolls off; a truncated console is a common reason hits get missed.
• Positive signal: JSON results arrays are non-empty with populated Login/Password fields, and a recovered cred authenticates — crackmapexec smb <range> -u <user> -p '<pass>' returns Pwn3d! or [+].
• Don't conclude "no credentials present" until: (1) ran both as the user and elevated/SYSTEM, (2) every browser profile path was reachable (no locked profiles), (3) wifi/sysadmin/databases modules ran, and (4) at least one recovered cred was validated against AD/SMB.