TechKnowSurge

VideoSecurityFree

Credential Harvesting

Credential harvesting is the large-scale theft of usernames, passwords, and other login data from networks, systems, or web applications. Common methods include malware, phishing campaigns, domain spoofing, and adversary-in-the-middle attacks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Credential harvesting is the deliberate, large-scale theft of authentication data — including usernames, passwords, and other login information — from targeted networks, systems, or web applications. What separates it from incidentally discovering a single set of credentials is its scale; a true harvesting operation captures bulk data, such as an entire database of user accounts pulled from a compromised machine or application. The closely related term credential dumping describes the same mass-collection objective and is widely treated as interchangeable in the industry. Harvested credentials may be the primary goal of an operation or may serve as a means of deepening access and expanding an attack already underway. Attackers carry out credential harvesting through several well-established techniques. Malware — particularly Trojans — can silently capture login input as users authenticate to systems. Phishing campaigns use deceptive emails to trick users into voluntarily submitting their credentials. Domain spoofing involves standing up convincing replica sites where victims enter their login details, unknowingly handing them to the attacker. Adversary-in-the-middle attacks intercept credentials as they travel across a network, capturing authentication data in transit without the user's knowledge. Each of these methods can be applied against internal network infrastructure, external-facing web applications, or end users directly, making credential harvesting a persistent and versatile threat across the attack lifecycle.

What you'll learn

Define credential harvesting and distinguish it from incidental credential discovery, including its scale and overlap with credential dumping
Identify common attack techniques used to conduct credential harvesting, including malware, phishing, domain spoofing, and adversary-in-the-middle attacks

What's covered

Credential Harvesting

Core Concept
- Stealing credentials at scale
- Usernames and passwords
- Also called credential dumping
Goals and Context
- Primary attack objective
- Enable further network access
- Web apps or internal networks
Attack Methods
- Malware or Trojans
- Phishing campaigns
- Domain spoofing
- Adversary in the middle
Scale Requirement
- Mass credential theft
- Database of credentials

Key terms

Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Trojan Horse: Malware disguised as legitimate software that performs malicious actions when executed.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Credential Harvesting: A technique used by attackers to capture usernames and passwords by impersonating a trusted application or login interface.
Credential Dumping: The extraction of large quantities of stored credentials from a compromised system or database, closely overlapping with credential harvesting.

Topics

Credential Harvesting Credential Dumping Phishing Adversary In The Middle Domain Spoofing Malware Cybersecurity

Transcript

One of the things that we may do when we hack into a network is credential harvesting. This is looking for credentials on the network. That could be our main goal, or perhaps we are looking for credentials to be able to find out more information about this network or carry out our attack.

Credential harvesting is not specific to our discovery within the network. We could be doing this against something like a web application. But a lot of times, once we get into a network, we are going to be looking for credentials inside of this network and carrying out some sort of credential harvesting attack.

Scale is what makes it harvesting

One key aspect to credential harvesting is the scale of it. If you happen to run across a username and password on a machine, that is not really credential harvesting. It really is doing this on a scale where you are grabbing large amounts of usernames and passwords, or some sort of other identification information or login information. So maybe we grab a database of usernames and passwords on a machine, or a database of usernames and passwords from some sort of web application.

Another similar term to credential harvesting, which has a lot of overlap, would be credential dumping. You can think of it as the same thing: dumping a bunch of credentials and stealing a bunch of credentials all at the same time.

How the attack is carried out

Malware. Maybe it is some sort of Trojan that we have where people are entering in their usernames and passwords, it is tricking them, and then we are gathering that information.
A phishing campaign, where we are sending out emails to trick people into sending us their credentials.
Domain spoofing, where we have a set up website where they can come in and enter in their usernames and passwords and now we have a hold of that.
An adversary in the middle, where we are sitting in the middle of this traffic and we are grabbing this information as it is coming across.

This could be any kind of credential information that users use to log into systems.

So here is the attack card on credential harvesting. The idea is stealing credentials in mass, and the example is stealing maybe a database full of usernames and passwords.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →