Credentials
Windows stores credentials using DPAPI's symmetric encryption, protected by user keys stored in %APPDATA%\Microsoft\Protect\%sid%
. There are a number of tools for accessing these included with Windows:
- Credential Manager, which won't show corrupted and "hidden" entries.
rundll32.exe keymgr.dll,KRShowKeyMgr
to show entries.cmdkey
vaultcmd
For easier access to values, NirSoft CredentialsFileView may be useful.