citronneur/pamspy

Health v2 · maintenance only

Adoption not part of the score

1164 stars · 62 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

pamspy is a Linux credentials dumper that uses eBPF to hook the pam_get_authtok function in libpam.so, capturing passwords from processes like sudo, sshd, and passwd. It is distributed as a static binary with no dependencies and can run in daemon mode writing captured credentials to a file.

Use cases

• dump linux passwords with ebpf
• capture sudo and ssh credentials on a compromised host
• red team credential harvesting on linux
• hook pam authentication to intercept passwords
• alternative to 3snake for credential dumping
• monitor pam authentication events in real time

When to choose

• you need to capture PAM-based credentials on a Linux host where you have root access
• you want a dependency-free static binary for red team operations
• you prefer eBPF-based hooking over LD_PRELOAD or ptrace techniques

When to avoid

• you are on a system without eBPF support or without root privileges
• you need a defensive auditing tool rather than credential capture
• your target uses authentication not routed through PAM

Facets

cli-tool · maturity active

security monitoring tracing security penetration-testing operating-systems cli ebpf credentials-dumper pam red-team offensive-security linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="citronneur/pamspy")