# In-memory secrets

## Theory

Just like the LSASS process on Windows systems allowing for [LSASS dumping](/a-d/movement/credentials/dumping/lsass.md), some programs sometimes handle credentials in the memory allocated to their processes, sometimes allowing attackers to dump them.

## Practice

{% hint style="info" %}
Just like [LSASS dumping](/a-d/movement/credentials/dumping/lsass.md), this technique needs the attacker to have admin access on the target machine since it involves dumping and handling volatile memory.
{% endhint %}

{% tabs %}
{% tab title="UNIX-like" %}
On UNIX-like systems, tools like [mimipenguin](https://github.com/huntergregal/mimipenguin) (C, Shell, Python), [mimipy](https://github.com/n1nj4sec/mimipy) (Python) and [LaZagne](https://github.com/AlessandroZ/LaZagne) (Python) can be used to extract passwords from memory.

```bash
mimipenguin
laZagne memory
```

{% endtab %}

{% tab title="Windows" %}
On Windows systems, tools like [LaZagne](https://github.com/AlessandroZ/LaZagne) (Python) and [mimikatz](https://github.com/gentilkiwi/mimikatz) (C) can be used to extract passwords from memory but they focus on [LSASS dumping](/a-d/movement/credentials/dumping/lsass.md).
{% endtab %}
{% endtabs %}

## Resources


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://legacy.thehacker.recipes/a-d/movement/credentials/dumping/passwords-in-memory.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.