skelsec/pypykatz

Health v2 · maintenance only

Adoption not part of the score

3352 stars · 430 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

pypykatz is a pure Python implementation of parts of Mimikatz, the well-known Windows credential extraction tool. It parses LSASS process memory (live, minidump, or full memory dumps) and registry hives to extract credentials such as NT/LM hashes, domain cached credentials, and LSA secrets.

Use cases

• extract credentials from an LSASS minidump
• parse NT and LM hashes from Windows registry hives
• dump passwords from a live Windows LSASS process
• analyze Windows memory dumps for stored credentials
• extract domain cached credentials (DCC/DCC2) from registry
• use mimikatz-like functionality on Linux or macOS
• integrate credential parsing into a Python pentesting tool

When to choose

• you need Mimikatz-like LSASS/registry credential parsing on a non-Windows platform
• you want a scriptable Python library for credential extraction rather than a Windows binary
• you need to process offline artifacts like minidumps or memory images
• you want to integrate credential parsing into your own tooling

When to avoid

• you need the full Mimikatz feature set, such as kerberos ticket manipulation or pass-the-hash execution
• you are not authorized to use credential extraction tools - this is offensive security software
• you need a pure Windows-native tool with the latest protocol support

Facets

cli-tool · maturity active

security penetration-testing parser cli security penetration-testing windows python windows cross-platform cli mimikatz credential-dumping lsass credential-extraction red-team registry-hives minidump linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="skelsec/pypykatz")