mimikatz
A Windows security tool for extracting credentials, hashes, and Kerberos tickets from memory and performing various post-exploitation techniques.
What is mimikatz?
mimikatz is a Windows security tool that extracts authentication credentials like passwords, hashes, and Kerberos tickets from system memory. It enables security professionals to demonstrate vulnerabilities in Windows authentication mechanisms and perform post-exploitation techniques such as pass-the-hash and golden ticket attacks.
Security researchers, penetration testers, red teamers, and system administrators who need to audit Windows security or understand credential exposure risks.
mimikatz provides deep, low-level access to Windows security subsystems that few other tools offer, making it indispensable for realistic security assessments and educational exploration of Windows authentication flaws.
Overview
A little tool to play with Windows security
Use Cases
Best For
- Extracting plaintext passwords from Windows memory during penetration tests
- Demonstrating pass-the-hash attacks in Active Directory environments
- Creating golden tickets for persistent domain persistence
- Dumping LSA secrets and cached domain credentials
- Exporting certificates and cryptographic keys from Windows systems
- Simulating DCSync attacks to extract password data from domain controllers
Not Ideal For
- Security teams requiring stealthy penetration testing tools with low antivirus detection rates
- Projects needing cross-platform credential extraction for Linux or macOS systems
- Organizations seeking automated security auditing with integrated compliance reporting
- Beginners looking for user-friendly, GUI-based security testing with guided tutorials
Pros & Cons
Pros
Extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory, as demonstrated in the README example with sekurlsa::logonpasswords.
Supports pass-the-hash, pass-the-ticket, and golden ticket creation for realistic penetration testing in Active Directory environments, with commands detailed in the quick usage section.
Interacts with Windows cryptographic APIs (CAPI/CNG) and dumps LSA secrets, providing low-level access to core security mechanisms like vault and DCSync.
Builds for x86, x64, and ARM64 architectures, as noted in the build instructions, ensuring broad system support across different Windows versions.
Maintained with continuous integration on AppVeyor and a public wiki, showing ongoing updates and community resources for troubleshooting.
Cons
Requires specific versions of Visual Studio or Windows Driver Kit 7.1, and the README mentions potential errors like MSB3073, making setup cumbersome for casual users.
Key resources such as the author's blog are in French, limiting accessibility for non-French speakers despite the English README.
Designed solely for Windows systems, with no support for other operating systems, restricting its use in heterogeneous environments.
As a well-known hacking tool, mimikatz is frequently flagged by security software, reducing its effectiveness in stealthy operations without modification.
Frequently Asked Questions
Related Projects
Metasploit FrameworkMetasploit Framework
SQLMapAutomatic SQL injection and database takeover tool
MasscanTCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
Ciphey⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.