> For the complete documentation index, see [llms.txt](https://wiki.pentestlist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery.md).

# Credential Discovery

- [Passwords and NetNTLM](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/passwords-and-netntlm.md): How to find cleartext passwords and NetNTLM hashes.
- [SAM & LSA secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/sam-and-lsa-secrets.md): How to find local user passwords, hashes and secrets.
- [NTDS.dit secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/ntds.dit-secrets.md): How to find sensitive data in NTDS.dit.
- [LSASS secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/lsass-secrets.md): How to find sensitive data in the LSASS.
- [DCSync](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/dcsync.md): How to find sensitive data using a DCSync.
- [DPAPI secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/dpapi-secrets.md): How to find local user sensitive data.