Dataview (inline field '= WDIGEST [14ab89]==
username bob
domainname DESKTOP-33E7O54
password None
password (hex)'): Error:
-- PARSING FAILED --------------------------------------------------
> 1 | = WDIGEST [14ab89]==
| ^
2 | username bob
3 | domainname DESKTOP-33E7O54
Expected one of the following:
'(', 'null', boolean, date, duration, file link, list ('[1, 2, 3]'), negated field, number, object ('{ a: 1, b: 2 }'), string, variable
LSASS caches credentials used by WDIGEST in clear-text.
Modern Windows operating systems have WDIGEST disabled by default
Additionally, it is essential to note that Microsoft released a security update for systems affected by this issue with WDIGEST.
Kerberos
== Kerberos ==
Username: bob
Domain: DESKTOP-33E7O54
Dataview (inline field '= Kerberos ==
Username: bob
Domain: DESKTOP-33E7O54'): Error:
-- PARSING FAILED --------------------------------------------------
> 1 | = Kerberos ==
| ^
2 | Username: bob
3 | Domain: DESKTOP-33E7O54
Expected one of the following:
'(', 'null', boolean, date, duration, file link, list ('[1, 2, 3]'), negated field, number, object ('{ a: 1, b: 2 }'), string, variable
Kerberos is a network authentication protocol used by Active Directory in Windows Domain environments.
Domain user accounts are granted tickets upon authentication with Active Directory.
This ticket is used to allow the user to access shared resources on the network that they have been granted access to without needing to type their credentials each time.
LSASS caches passwords, ekeys, tickets, and pins associated with Kerberos.
It is possible to extract these from LSASS process memory and use them to access other systems joined to the same domain.
The Data Protection Application Programming Interface or DPAPI is a set of APIs in Windows operating systems used to encrypt and decrypt DPAPI data blobs on a per-user basis for Windows OS features and various third-party applications.
Applications
Use of DPAPI
Internet Explorer
Password form auto-completion data (username and password for saved sites).
Google Chrome
Password form auto-completion data (username and password for saved sites).
Outlook
Passwords for email accounts.
Remote Desktop Connection
Saved credentials for connections to remote machines.
Credential Manager
Saved credentials for accessing shared resources, joining Wireless networks, VPNs and more.