Credential Attacks
Credential dumping, password spraying, pass-the-hash, pass-the-ticket, token theft and the defences that stop them.
What are Credential Attacks?
Credential attacks abuse material that already exists on a host or directory service — hashes, tickets, tokens and cached secrets — instead of guessing passwords from outside. They are the bridge between initial access and full domain compromise.
Documented for defensive understanding, authorised testing and exam preparation only.
Credential Dumping
| Source | Contents | Access required |
|---|---|---|
| LSASS memory | NTLM hashes, Kerberos tickets, sometimes plaintext | Local admin |
| SAM + SYSTEM hives | Local account NTLM hashes | Local admin |
| NTDS.dit | Every domain account hash | Domain Controller / DA |
| LSA secrets | Service account passwords, DPAPI keys | Local admin |
| Credential vaults | Saved application and browser passwords | User context |
| /etc/shadow | Linux hashes (yescrypt, SHA-512) | root |
Attack Techniques
Password Spraying
One or two common passwords tried against many accounts, staying under lockout thresholds.
Credential Stuffing
Reuse of username/password pairs leaked in unrelated breaches. Defeated by unique passwords and MFA.
Pass-the-Hash (PtH)
NTLM authentication needs the hash, not the password — a dumped NT hash is enough to authenticate.
Pass-the-Ticket (PtT)
Stolen Kerberos TGT/TGS tickets are replayed for access. Related: Kerberoasting and AS-REP Roasting, which yield service tickets that are cracked offline.
Access Token Manipulation
Impersonating an existing Windows token — lateral movement without ever handling a credential.
Keylogging and Credential Phishing
Capturing secrets at the point of entry, bypassing hashing entirely.
Typical Attack Chain
initial access -> local privilege escalation -> credential dump
-> offline cracking / hash reuse -> lateral movement -> domain dominance
Defences
| Control | Blocks |
|---|---|
| MFA everywhere | Spraying, stuffing, phished passwords |
| LAPS / unique local admin passwords | Pass-the-hash lateral movement |
| Credential Guard + Protected Users | LSASS dumping, ticket theft |
| Tiered administration | Admin hashes landing on workstations |
| Long, random service account passwords | Kerberoasting |
| Lockout + spray detection alerting | Password spraying |
| Disable legacy NTLM where possible | PtH and relay attacks |
Quick Reference
- Hashes are credentials, not just artefacts — treat them like plaintext.
- Anywhere a hash can authenticate, cracking is optional.
- Detection focuses on abnormal LSASS access, unusual ticket requests and auth anomalies.
- Rotate every exposed secret after an incident, including the krbtgt account twice.
Related articles
System Hacking Overview
Goals of system hacking — gaining access, privilege escalation, persistence and log clearing — plus where credential hashes come from.
🔐 Password Cracking
Educational guide covering password hashing, hash identification, Hashcat, John the Ripper, wordlists, attack methods, common hash formats, and the interactive hash identifier.
Steganography
Beginner-friendly steganography study guide: core concepts, stego vs crypto, types, tools, workflow, beginner tips and an interactive browser-only lab.
🚀 Metasploit Framework
Complete educational guide to the Metasploit Framework, including msfconsole, modules, payloads, Meterpreter, auxiliary modules, exploitation workflow, post-exploitation, pivoting, resource scripts, plugins, troubleshooting, practical labs, and OSCP-oriented usage.