Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
blindsight — Red teaming tool to dump LSASS memory, bypassing basic countermeasures. | Kitploit
Tools/GitHubGitHub/0xdea/blindsight
IDS/IPS EvasionPost-ExploitationRed Teaming
GitHub0xdea/blindsight

blindsight

Red teaming tool to dump LSASS memory, bypassing basic countermeasures.

View RepositoryWebsite
2482731 month agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

blindsight

"There's no such things as survival of the fittest.
Survival of the most adequate, maybe.
It doesn't matter whether a solution's optimal.
All that matters is whether it beats the alternative."

-- Peter Watts, Blindsight (2006)

Red teaming tool to dump LSASS memory, bypassing basic countermeasures. It uses Transactional NTFS (TxF API) to transparently scramble the memory dump, to avoid triggering AV/EDR/XDR.

Article

  • https://hnsecurity.it/blog/an-offensive-rust-encore

See also

  • https://attack.mitre.org/techniques/T1003/001/
Download Tool
  • https://www.synacktiv.com/en/publications/windows-secrets-extraction-a-summary
  • https://www.ired.team/offensive-security/credential-access-and-credential-dumping
  • https://github.com/fortra/nanodump
  • https://github.com/w1u0u1/minidump
  • https://github.com/anthemtotheego/CredBandit
  • https://github.com/joaoviictorti/RustRedOps
  • https://github.com/Kudaes/Dumpy

    • Cross-compiling (macOS example)

    root@kitploit:~
    $ brew install mingw-w64
$ rustup target add x86_64-pc-windows-gnu
$ cargo build --release --target x86_64-pc-windows-gnu

    Usage

    Inside an Administrator's PowerShell window:

    root@kitploit:~
    C:\> .\blindsight.exe [dump | file_to_unscramble.log]

    Examples

    Dump LSASS memory:

    root@kitploit:~
    C:\> .\blindsight.exe

    Unscramble memory dump:

    root@kitploit:~
    C:\> .\blindsight.exe 29ABE9Hy.log

    Tested on

    • Microsoft Windows 10 (x64)
    • Microsoft Windows 11 (x64)
    • Microsoft Windows 11 (ARM64)
    • Microsoft Windows Server 2016 (x64)
    • Microsoft Windows Server 2019 (x64)
    • Microsoft Windows Server 2022 (x64)

    [!CAUTION] Do not test on production servers, as accessing LSASS might cause system instability!

    TODO

    • Optimize memory usage (simply corrupt "magic bytes" instead of XORing?)
    • Use litcrypt2 or similar to encrypt strings locally
    • Allow to manually specify LSASS pid to avoid noisy process scans
    • Avoid directly opening LSASS handle (e.g., via PssCaptureSnapshot)
    • Use https://github.com/Kudaes/DInvoke_rs or similar for API hooks evasion
    • https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
    • Implement fileless exfiltration channels (e.g., TFTP, FTP, HTTP...)
    • Consider dumping to memory using minidump callbacks instead of TxF API
    • https://adepts.of0x.cc/hookson-hootoff/
    • Consider better command line handling if minimal is not enough