mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.7 KiB
1.7 KiB
Workflows - LaZagne Credential Access
Credential Harvesting Workflow
1. Pre-Execution
├── Verify access level (standard user vs. admin/SYSTEM)
├── Check AV/EDR status on target
├── Prepare output directory for results
└── Plan exfiltration method for credential data
2. Execution
├── Run lazagne.exe all -oJ for full extraction
├── Run specific modules if full scan is too noisy
├── Elevate to SYSTEM if needed for DPAPI/LSA
└── Collect output files
3. Analysis
├── Parse JSON output
├── Deduplicate credentials
├── Categorize by source (browser, email, system, etc.)
└── Prioritize by value (domain creds > local > web)
4. Validation
├── Test domain credentials with CrackMapExec
├── Verify cloud credentials (AWS CLI, Azure CLI)
├── Check VPN/remote access credentials
└── Map credentials to BloodHound attack paths
5. Lateral Movement
├── Use validated credentials for next hop
├── Repeat credential harvesting on new targets
└── Document credential chain for report
Module Execution Priority
High Priority (run first):
browsers → Web application credentials, SSO tokens
windows → Domain cached credentials, DPAPI
sysadmin → SSH keys, RDP credentials, PuTTY
Medium Priority:
databases → Database connection strings
mails → Email credentials for BEC
git → Source code repository access
Low Priority:
wifi → Network access but limited value
chat → Communication platform access
svn → Legacy source control