pamspy

pamspy -- Credentials Dumper for Linux pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. It will track a particular userland function inside the PAM Pluggable Authentication Modules library, used by many critical applications to handle authentication like: sudo sshd passw...

3snake

3snake - dump sshd and sudo credential related strings Disclaimer I Wrote This In College About Targeting rooted servers, reads memory from sshd and sudo system calls that handle password based authentication. Doesn't write any memory to the traced processes. Spawns a new process for every sshd a...