pwdump is the name of various Windows programs that outputs theLM andNTLM password hashes of local user accounts from theSecurity Account Manager (SAM) database and from the Active Directory domain's users cache on the operating system.
It is widely used, to perform both the famous pass-the-hash attack, or also can be used to brute-force users' password directly. In order to work, it must be run under an Administrator account, or be able to access an Administrator account on the computer where the hashes are to be dumped. Pwdump could be said to compromise security because it could allow a malicious administrator to access user's passwords.[1]
 | This sectionneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources in this section. Unsourced material may be challenged and removed.(June 2023) (Learn how and when to remove this message) |
The initial program called pwdump was written byJeremy Allison. He published thesource code in 1997 (seeopen-source).[2] Since then there have been further developments by other programmers:
| This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Pwdump" – news ·newspapers ·books ·scholar ·JSTOR(June 2017) (Learn how and when to remove this message) |
 | This security software article is astub. You can help Wikipedia byexpanding it. |