pypykatz is a Python implementation of some of the functionality provided by Mimikatz, a well-known Windows credential analysis tool.
It allows investigators to extract credential information from Windows memory dumps and other forensic artefacts without requiring the analysis to be performed on a Windows system.
The software separates its parsing functionality from the underlying data sources. This makes it possible to examine LSASS process minidumps, supported memory images and Windows Registry hives. It can recover information such as password hashes, cached credentials, Kerberos authentication material and LSA secrets.
pypykatz also provides functionality for analysing data protected by the Windows Data Protection API (DPAPI), including master keys, credential files and vault data. Some functionality is experimental, and successful recovery depends on the available evidence and Windows version.
This is free and open source software.
Key Features
- Parses Windows LSASS process memory to recover authentication information.
- Supports offline analysis of LSASS minidumps and compatible memory images.
- Extracts NT and LM hashes, cached domain credentials and LSA secrets from Registry hives.
- Provides DPAPI analysis for master keys, protected data blobs, credential files and vaults.
- Separates data acquisition from parsing to support different forensic workflows.
- Offers command-line tools and a Python library for integration with other applications.
- Live acquisition functionality is available on Windows.
- Cross-platform support – runs on Linux, macOS, and Windows.
Website: github.com/skelsec/pypykatz
Support:
Developer: Tamas Jos
License: MIT License
pypykatz is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| PCILeech | Security research and memory acquisition tool |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| LeechCore | Physical memory acquisition library |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| mquire | Memory forensics and analysis tool |
| LEMON | Memory acquisition utility |
| yarp | Yet Another Registry Parser |
| emd | Command line memory acquisition tool for Linux systems |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.