6. If you cannot capture the password, what alternatives are there?

• Search for stored passwords in files left by operators
• Pass‑the‑hash
• Retrieve passwords from browsers