
## General

Credential harvesting is a technique for obtaining credentials like login information, account names, and passwords by extracting them from various locations such as clear-text files, registry, memory dumping, etc. Additionally, it also refers to gaining access to user and system credentials through techniques such as network sniffing, where an attacker captures transmitted credentials.

As a red teamer, gaining access to legitimate credentials has benefits:

- It can give access to systems (Lateral Movement).
- It makes it harder to detect our actions.
- It provides the opportunity to create and manage accounts to help achieve the end goals of a red team engagement.

Credentials can be found in a variety of different forms, such as:

- Accounts details (usernames and passwords)
- Hashes that include NTLM hashes, etc.
- Authentication Tickets: Tickets Granting Ticket (TGT), Ticket Granting Server (TGS)  
- Any information that helps login into a system (private keys, etc.)