Skip to main content

4. How would you capture passwords?

Use procdump to dump the LSASS process memory, then use mimikatz to read credentials offline.