Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Lsass-Shtinkering — Dumps LSASS memory by abusing Windows Error Reporting service over ALPC, enabling credential extraction and offline analysis on Windows systems. | Kitploit
Tools/GitHubGitHub/deepinstinct/lsass-shtinkering
ExploitationPost-ExploitationPenetration TestingRed Teaming
GitHubdeepinstinct/lsass-shtinkering

Lsass-Shtinkering

Dumps LSASS memory by abusing Windows Error Reporting service over ALPC, enabling credential extraction and offline analysis on Windows systems.

View Repository
3834323 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Lsass Shtinkering

New method of dumping LSASS by abusing the Windows Error Reporting service. It sends a message to the service with the ALPC protocol to report an exception on LSASS. This report will cause the service to dump the memory of LSASS.

Prerequisites

The registry value "DumpType" under "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" should be set to 2.

Credits

  • Asaf Gilboa

References

  • https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
Download Tool