LaZagne

LaZagne queries supported local applications and credential stores. The report recovers saved application credentials. It does not grant a new identity simply by being run.

Select a narrow collection

whoami
.\laZagne.exe -h
.\laZagne.exe browsers -h
.\laZagne.exe browsers
.\laZagne.exe browsers -firefox

Run under the profile whose store you are reviewing. Administrator rights can increase coverage, but store encryption, available keys and application version still matter. Current browser protections can make an older module unable to decrypt a value.

Preserve a controlled result

New-Item -ItemType Directory -Path 'C:\Lab\Evidence' -Force
.\laZagne.exe browsers -oJ -output 'C:\Lab\Evidence'

Avoid broad all collection when a single browser is enough. Output may contain plaintext credentials: keep it out of public notes. Classify each result by application, account and retrieval context.

Success: a particular saved credential is recovered and, if required by scope, validated on one named service. Separate recovery from successful login and separate a local account from a same-named domain account. Redact the value in evidence. Fix unsafe storage and account reuse, and rotate confirmed exposed credentials.

Choose a collection context

Context	Expected coverage	Limitation
Normal logged-on user	That profile’s supported application stores	Other profiles and machine stores may be inaccessible
Elevated same user	Additional readable stores	Elevation does not supply every other user’s decryption keys
LocalSystem	Some machine/service stores	User-specific encryption can still require user material
Offline copied profile	Files may be available	Live API/key context may be absent

Record the user, profile path and elevation before interpreting recovered values:

whoami /all
$env:USERPROFILE
[Environment]::Is64BitProcess
Get-FileHash .\laZagne.exe -Algorithm SHA256

Select a category before a module

.\laZagne.exe -h
.\laZagne.exe browsers -h
.\laZagne.exe browsers -firefox -vv

Use the current help to discover available modules on this platform. The Linux Python entry point and Windows standalone differ in packaging and supported applications. Do not treat a missing module on one platform as proof the store does not exist.

Interpret results by source

Returned item	Validate before using it
Browser username/password	Origin URL, profile and whether the account still exists
Connection-manager credential	Host, protocol and whether the saved realm is local or domain
Wi-Fi key	SSID/profile role; unrelated to AD login unless separately confirmed
Token or encrypted blob	Whether the tool actually decrypted it and what application accepts it
Empty password	Empty stored value, parse failure or unsupported protection

Deduplicate by application, destination and username. Identical account names do not mean identical identities, and an old saved password can remain in a store after rotation.

Troubleshoot a narrow run

Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -ErrorAction SilentlyContinue
.\laZagne.exe browsers -firefox -vv -oJ -output 'C:\Lab\Evidence'

Symptom	Check
Profile not found	Which user’s environment the process uses
Database locked	Application activity; prefer a consistent reviewed copy when supported
Decryption failure	User context, available keys, master password and application version
Module import/runtime error	Standalone architecture or Python dependencies
JSON parser rejects output	Actual export structure; some versions emit multi-line JSON records

Current browser protections may exceed an older module’s coverage. Diagnose the exact store and version rather than retrying all with broader permissions immediately.

Evidence and remediation

Save a redacted record containing module, destination, username and retrieval context. A separately approved login proves validity; it does not change the fact that local recovery depended on the original profile’s access. Rotate confirmed exposed values, address unsafe storage and reduce credential reuse. To identify broader local permission paths continue with linPEAS & winPEAS.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.