What is this?
LaZagne is an open-source tool that retrieves passwords stored locally on a computer by reverse-engineering the storage method of each software (plaintext, APIs, custom algorithms, databases, etc.).
LaZagne is an open-source tool that retrieves passwords stored locally on a computer by reverse-engineering the storage method of each software (plaintext, APIs, custom algorithms, databases, etc.).Is this a GUI app or a command-line tool?It is a Python command-line tool, run module by module from a terminal; it also exists as a post-exploitation module for the pupy framework.
It is a Python command-line tool, run module by module from a terminal; it also exists as a post-exploitation module for the pupy framework.How do I run it?Run it from source with Python, or grab a precompiled standalone executable; you can launch all modules at once, a specific module, or a single software script, and write results to a file with -oN, -oJ or -oA.
Run it from source with Python, or grab a precompiled standalone executable; you can launch all modules at once, a specific module, or a single software script, and write results to a file with -oN, -oJ or -oA.Do I need admin rights for everything?Most modules run as a normal user, but Wifi passwords and Windows Secrets require administrator privileges (UAC or sudo), and domain credential decryption needs the Windows user password.
Most modules run as a normal user, but Wifi passwords and Windows Secrets require administrator privileges (UAC or sudo), and domain credential decryption needs the Windows user password.Does it work well on Mac OS?On macOS it is much weaker without the user's login password; the author recommends supplying it via command line or using the interactive mode that prompts the user for it.
On macOS it is much weaker without the user's login password; the author recommends supplying it via command line or using the interactive mode that prompts the user for it.Which operating systems does it support?Windows, Linux and Mac OS, each with a different set of supported software and recovery techniques.
Windows, Linux and Mac OS, each with a different set of supported software and recovery techniques.What kind of software can it pull passwords from?Dozens of categories: browsers (Chrome, Firefox, Opera, Vivaldi...), chat clients, databases, mail clients, Git, SVN, sysadmin tools (FileZilla, PuTTY, VNC, SSH keys, AWS, Docker), Wi-Fi networks, and internal OS password stores like Windows DPAPI, LSA secrets, Vault, Keychains, and GNOME Keyring.
Dozens of categories: browsers (Chrome, Firefox, Opera, Vivaldi...), chat clients, databases, mail clients, Git, SVN, sysadmin tools (FileZilla, PuTTY, VNC, SSH keys, AWS, Docker), Wi-Fi networks, and internal OS password stores like Windows DPAPI, LSA secrets, Vault, Keychains, and GNOME Keyring.How do I compile it into a standalone executable?LaZagne can be compiled into a standalone binary using either PyInstaller or Nuitka.
LaZagne can be compiled into a standalone binary using either PyInstaller or Nuitka.Can I decrypt Windows domain credentials with it?Yes - you can specify the user's Windows password to decrypt domain credentials, or let it brute-force using passwords it already recovered on that machine.
Yes - you can specify the user's Windows password to decrypt domain credentials, or let it brute-force using passwords it already recovered on that machine.Does it touch disk when used as a post-exploitation module?No, when used through pupy, its Python code is interpreted in memory without writing to disk.
No, when used through pupy, its Python code is interpreted in memory without writing to disk.What are similar projects?thc-hydra, hacker-roadmap, mimikatz, evilginx2, fsociety, john, Claude-Red, nikto
thc-hydra, hacker-roadmap, mimikatz, evilginx2, fsociety, john, Claude-Red, niktoWhich topics is it in?penetration-testing-tools, credentials, password-cracking, post-exploitation, security-testing, password, redteam, hacking-tool, pentesting, reverse-engineering, cybersecurity, browser
penetration-testing-tools, credentials, password-cracking, post-exploitation, security-testing, password, redteam, hacking-tool, pentesting, reverse-engineering, cybersecurity, browser