# Credentials from Password Stores

**ATT\&CK ID:** [T1555](https://attack.mitre.org/techniques/T1555/)

**Description**

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

## Sub Techniques

### T1555.003: Credentials from Web Browsers

{% content-ref url="/pages/CgMsKp5Lc0zPQfU5dqvH" %}
[Credentials from Web Browsers](/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/credentials-from-web-browsers.md)
{% endcontent-ref %}

### T1555.004: Windows Credential Manager

{% content-ref url="/pages/rt4laKQSU0kOxVIIDwkw" %}
[Windows Credential Manager](/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/windows-credential-manager.md)
{% endcontent-ref %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.