In this final demo,
we're going to look at what LaZagne will do if we just tell it to go
ahead and find every password it can. In Windows,
there are a lot of modules and it would take a long time to
work out which software is on a machine.
Getting LaZagne to try to find as many passwords as it can
might not be the quietest thing to do, but it could
certainly save you a lot of time.
We're also going to take a look at the output formats available for
LaZagne. Automation is an important part of security, so it's certainly
useful when tools can generate formatted output.
Starting with our LaZagne executable, we'll look at the help and
see the options available. In the other demos, we've done this
for individual options, but here, we're doing it at the top
level without any options.
Here,
we can see a long list of commands we can give and each one has a number
of modules beneath it. The one at the top there is all and that allows
us to run every module that LaZagne has.
Let's give it a try. We see it give us various passwords that it's found.
That's great.
But we've seen that in previous demos too, so it's perhaps no more special.
Let's take a look at the verbose output Here,
we can see some messages at the end in red seeing that LaZagne is trying to
use the passwords it's already found to decrypt master keys.
What's happening here is that it's found lots of passwords
and now it's using those passwords to try to decrypt stored
data for users of this machine.
It's trying to use the passwords it found to find more passwords.
Pretty cool.
Finally,
we'll get a look at getting all of those passwords into
something that might help with automation.
A quick look at the help shows us the options.
We're going to output in all formats and stick with the default,
which will put the files in our current directory.
Once that's complete, we'll open up the JSON file.
JSON tends to be good if you're going to programmatically use the file
so perhaps if you're going to use Python to read it,
We can see all the deals in there.
Opening up the text file, we can see essentially
everything we see on the screen.
If using something like Grep is more your style,
then this is the direction you're likely to take.