creddump7
open-sourceThe section your link pointed to isn't on creddump7's page any more, so we've brought you to the top.
Extracts cached domain credentials, LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools. secrets, and LM/NT hashes from Windows registry hives offline.
Summary
creddump7 is an open-source, free command-line tool that pulls credentials out of Windows registry hives offline, extracting LM and NT password hashes, cached domain credentials, and LSA secrets without needing a running Windows system. It works from copies of the SYSTEM, SECURITY, and SAM hives, so a mounted disk image or partition is enough, and output feeds straight into crackers like John the Ripper for mscash2 hashes. This fits red teamers and forensic investigators doing post-exploitation credential extraction, replacing the separate use of bkhive/samdump2, cachedump, and lsadump2 with one platform-independent script. Built as a fork of the original creddump project, it first appeared in 2014 and has drawn 8 contributors, but there have been no commits in the past year, so treat it as a stable but unmaintained tool.
Extracts cached domain credentials, LSA secrets, and LM/NT hashes from Windows registry hives offline.
How creddump7 helps
Which local Windows account passwords can I recover from a disk image without ever booting it?
reads the SYSTEM and SAM hives directly, decrypts the SYSKEY protection, and prints the LM and NT hashes for every local account it finds
Are there domain credentials cached on this machine from past logons?
pulls the cached domain password verifiers out of the SYSTEM and SECURITY hives and prints them in mscash2 format, one line per user with the domain name attached
What secrets is this machine holding in LSA storage — service account passwords, autologon credentials, stored keys?
decrypts the LSA secrets section of the SECURITY hive using the machine's own boot key and lists each secret by name
Can I turn these cached domain hashes into actual plaintext passwords?
formats the output so it drops straight into John the Ripper's mscash2 mode, so a wordlist or rule run against them recovers passwords when they're weak enough
Do I need three different legacy tools to get hashes, cached creds, and LSA secrets off this image?
runs all three extractions from one script against the same mounted hive files, replacing separate runs of bkhive/samdump2, cachedump, and lsadump2
Will this work on both older XP-style hive layouts and newer Vista/7 ones?
takes an explicit flag telling it which hive layout to parse, so the same script handles either generation of Windows registry structure
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release-note detail over time
See how much detail creddump7 puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Commercials
pricing & packaging history · Cisco vendor page63 readings of Cisco's pricing page since Jun 2022, with 39 relaunches of its plan lineup and 3 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.
Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.
See plans → Already subscribed? Sign in →Plans by offering
Each offering on the pricing page links to its own page of plans, read at its latest capture.
Plan relaunches
Plans, prices and descriptions are quoted from the vendor's own pricing page as we read it on each date. A plan missing from a later reading is shown as no longer listed on the page — a statement about the page, not the product. Readings that failed to show any plans are left out rather than read as a change.
Website history
snort.org, every changeCisco's home page and 23 more pages as they looked each month from August 2021 to October 2026: 35 renders, 0 changes of tagline or palette. Step through them, play them, or put any two months side by side.
Website history is included with Researcher and Business.
See plans → Already subscribed? Sign in →← → or h l a month · Shift a year · [ ] previous / next change · Space play · 1 2 3 page · T whole page · C compare · F full size
← → or h l the right month · Shift the left · S swap · W wipe · T whole page · Esc back
Rebranding timeline
Dates bound when a change appeared between captures. Possible rebrands are AI suggestions; a redesign alone does not establish a rebrand.
Releases
Nothing shipped since we started watching. Releases and docs updates land here as they happen.
Project health
Issue, contributor and maintainer activity in CiscoCXSecurity/creddump7, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors not measured distinct committers, last 12 months
- Maintainers not measured core set, last 12 months
- Bus factor not measured committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 2 of 3 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 2
- Contributors / month not measured
- Commits / month not measured
- Stars 412
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →