bitsadmin/fakelogonscreen

Health v2 · maintenance only

Adoption not part of the score

1378 stars · 236 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

FakeLogonScreen is a red-team utility that displays a fake Windows logon screen to capture a user's password, validating it against Active Directory or the local machine. Captured credentials are printed to the console or saved to disk, and it can be executed via Cobalt Strike's execute-assembly.

Use cases

• demonstrate social engineering risk in security awareness training
• harvest credentials during authorized red team engagements
• test endpoint detection of credential phishing tools
• capture user passwords in penetration testing scenarios
• run credential capture via Cobalt Strike execute-assembly

When to choose

• you are conducting an authorized penetration test or red team exercise on Windows
• you need a lightweight .NET-based credential phishing tool compatible with Cobalt Strike
• you want password validation against AD or local accounts to ensure captured credentials are correct

When to avoid

• you have no explicit authorization to test the target systems
• you need a general-purpose authentication or login solution
• you target non-Windows platforms

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows windows cli dotnet credential-harvesting red-team social-engineering cobalt-strike csharp

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bitsadmin/fakelogonscreen")