Directory Services Internals (DSInternals) PowerShell Module and Framework
Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.
Decrypt Chromium based browser passwords with PowerShell.
A C# tool to output crackable DPAPI hashes from user MasterKeys
Decrypt SCCM and DPAPI secrets with Powershell.
A collection of DPAPI hunting and parsing BOFs
Windows DPAPI JNA Wrapper
Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager
Extract DPAPI CREDHIST and Masterkey hashes
A DataProtect wrapper that uses DPAPI in Windows and AspNetCore.DataProtection in other platforms.
Utilities and files for SQL Server Management Studio 21 and 22
SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage
Local Windows desktop account switcher for Codex App with DPAPI-encrypted auth.json snapshots, quota viewer, and token usage dashboard.
Python application to scan user's installed browsers for secrets such as stored passwords and cookies.
Advanced Discord token recovery framework for Windows. Extracts tokens from 20+ Chromium browsers, Firefox, and Discord clients via AES-GCM/DPAPI decryption. Features parallel validation, webhook delivery with fallback, stealth mode, custom EXE icon builds, and full JSON configuration.
To associate your repository with the dpapi topic, visit your repo's landing page and select "manage topics."