Dumping Windows hashes
In this section, we will take a closer look at Windows passwords and how they are hashed. The hash dumping process on Windows can be performed by using various techniques and tools, most of which we will explore in this section. Before we begin using any tools or techniques, we need to take a brief look at how Windows passwords are stored.
SAM database
Security Account Manager (SAM) is a database that is responsible for managing user accounts and passwords on Windows. All the passwords that are stored in the SAM database are hashed. Authentication and verification of user credentials is facilitated by the local security authority (LSA).
The SAM database is stored in the Windows Registry and can be accessed from the following location:
HKEY_LOCAL_MACHINE\SAM
Now that we know where Windows user credentials are stored, we need to take a closer look at LanMan (LM) and NTLM authentication.
LM and NTLM hashing
LM is an authentication protocol...
