> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores.md).

# Credentials from Password Stores

**ATT\&CK ID:** [T1555](https://attack.mitre.org/techniques/T1555/)

**Description**

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

## Sub Techniques

### T1555.003: Credentials from Web Browsers

{% content-ref url="/pages/CgMsKp5Lc0zPQfU5dqvH" %}
[Credentials from Web Browsers](/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/credentials-from-web-browsers.md)
{% endcontent-ref %}

### T1555.004: Windows Credential Manager

{% content-ref url="/pages/rt4laKQSU0kOxVIIDwkw" %}
[Windows Credential Manager](/pentest-everything/everything/everything-active-directory/credential-access/credentials-from-password-stores/windows-credential-manager.md)
{% endcontent-ref %}