Extracting passwords from memory

We can begin the password mining process by exploring an uncommon technique that can be used to extract application passwords from memory. The viability and success of this technique will depend on the type of applications that are running on the target and its deployment use case.

Applications and services that utilize username and password authentication may store credentials in user-space memory, either in cleartext or in an encrypted state. Dumping and analyzing the memory of a particular service may reveal credentials pertinent to the application. We can use these credentials to gain access and take control of the particular service; alternatively, we can use the discovered credentials for authentication to other user accounts in order to elevate our privileges. This is because many users and system administrators are prone to reusing passwords for various applications and their user accounts.

We can use the GNU Debugger (GDB) to dump the...