Skip to content
Get packs

Abusing DPAPI for Credential Access

Guides an agent through recovering Windows DPAPI-protected passwords and cookies during authorized red-team tests.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

This skill teaches an AI agent how to extract and decrypt secrets that Windows protects with DPAPI, the built-in encryption service, such as saved Credential Manager passwords, browser logins and cookies, Wi-Fi keys and KeePass keys. It lays out three decryption routes (as the logged-in user, with a user's password or hash, or with the domain-wide backup key) and the commands for tools like SharpDPAPI, SharpChrome, Mimikatz and Impacket. It also includes a Python helper that finds DPAPI files in an exported user profile and runs those tools against them. This is offensive security tooling intended only for authorized penetration tests.

Great for

  • Authorized red-team operators testing credential-access paths on Windows domains
  • Purple-team staff validating detection of DPAPI master-key and Protect-folder access

Skip it if

  • Anyone testing systems they do not have written authorization to test, because extracting credentials without consent is illegal
  • Unauthorized access to personal or employer devices, since it harvests saved passwords and session cookies from real users

Try asking

  • “Triage this exported Windows user profile for DPAPI blobs and decrypt what you can with the supplied password”
  • “Using our domain backup key, decrypt the Credential Manager entries in this Credentials folder”
  • “Show me how to run SharpDPAPI triage in the current user's context after our authorized foothold”
Step-by-step guide: how to use Abusing DPAPI for Credential AccessInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    abusing-dpapi-for-credential-access.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip abusing-dpapi-for-credential-access.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip abusing-dpapi-for-credential-access.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this within a signed rules of engagement and log every action, as the skill itself requires.
  • Prefer offline decryption of exported profiles where possible to limit live impact on the host.
  • Review scripts/agent.py before running it, since it executes external tools against the supplied artifacts.

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.