Impacket vs Whisker
GitHub Stats
About Impacket
Impacket is a collection of Python classes for working with network protocols, essential for Windows and Active Directory pentesting. It provides low-level programmatic access to protocols like SMB, RDP, and LDAP, enabling the development of custom network tools and exploitation scripts. Impacket's extensive support for protocol manipulation makes it a critical resource for security researchers and penetration testers targeting Windows-based environments.
About Whisker
Whisker is a C# tool for performing the Shadow Credentials attack against Active Directory. The attack exploits the msDS-KeyCredentialLink attribute introduced for Windows Hello for Business, which allows certificate-based authentication via Kerberos PKINIT. By adding a rogue Key Credential entry to a target user or computer's msDS-KeyCredentialLink attribute (which requires write access to the attribute), an attacker can then authenticate as that principal using the corresponding private key, without knowing or changing their password. This is stealthier than traditional credential attacks because it doesn't modify the password or trigger password change events. Whisker generates the key pair, adds the Key Credential to the target, and can be combined with Rubeus to request TGTs using the shadow credential. It's particularly effective when you have GenericWrite or GenericAll permissions over user or computer objects.
Platform Support
Tags
Shared
Impacket only
Whisker only