Credential Harvesting Post-Compromise

You have code execution on a Windows or Linux host and need to harvest credentials to move laterally or escalate privileges.

**Windows Credential Locations**
- What is the LSASS process and what credentials does it hold in memory?
- How does Mimikatz extract credentials from LSASS? What privileges are required?
- What is the difference between sekurlsa::logonpasswords and lsadump::sam?
- What does Protected Users group membership do to credential caching in LSASS?

**LSASS Dump Techniques**
- Why might you avoid running Mimikatz directly on a host?
- How does `comsvcs.dll MiniDump` work as an LOLBin for LSASS dumping?
- How do you extract credentials from an offline LSASS dump?

**Windows SAM & DPAPI**
- What is the SAM database and how do you extract it offline?
- What does DPAPI protect and where are DPAPI blobs stored?
- How do you decrypt browser-saved passwords using DPAPI?

**Linux Credential Locations**
- What does `/etc/shadow` contain and how do you crack it offline?
- Where do applications commonly store credentials on Linux? (config files, .env, history files, bash_history)
- How do you extract SSH private keys and assess their value?

**Browser & Application Credentials**
- How do you extract saved passwords from Chrome, Firefox, and Edge on Windows?
- What credentials are stored in Windows Credential Manager and how do you dump them?
- Where do common applications (FileZilla, WinSCP, PuTTY) store saved credentials?

Output:
- Credential harvesting priority list (by value and ease)
- LOLBin LSASS dump commands
- Linux credential hunt checklist