admin/mandiant-gopacket
1
0
Fork 0
mirror of https://github.com/mandiant/gopacket synced 2026-06-21 13:57:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
Page: pkg dpapi
Pages
Architecture Overview Authentication Patterns End to End Examples Home Utility Packages pkg dcerpc pkg dpapi pkg ese pkg flags pkg kerberos pkg ldap pkg ntlm pkg registry pkg relay pkg security pkg session pkg smb
Clone
1
pkg dpapi
Jacob Paullus edited this page 2026-04-17 14:43:21 -05:00
Table of Contents

pkg/dpapi - DPAPI Decryption

Parse and decrypt Windows Data Protection API blobs, master keys, credential files, and vaults.

Types

Type Description
DPAPIBlob Encrypted DPAPI blob structure
MasterKey DPAPI master key
Credential Decrypted Windows credential
CredentialFile DPAPI credential file

Key Files

File Description
dpapi.go DPAPI blob structure and AES/3DES decryption
backupkey.go Domain DPAPI backup key extraction (via BKRP RPC)
credhist.go Credential history file parsing
vault.go Windows Vault parsing