In a physical penetration testing scenario, the penetration tester obtains physical access to a laptop following as a potential NEXT step to extract credentials from the device?

Brute forcing the local user password is slow, noisy, and often blocked by account lockout policies, making it far less efficient than passive credential capture over the network.

ARP spoofing is a network man-in-the-middle technique that intercepts traffic between hosts but does not directly extract stored credentials from a device.

BeEF (Browser Exploitation Framework) targets web browsers via JavaScript hooks and requires a victim to visit a malicious page, making it irrelevant to extracting credentials from a physically accessed laptop.

With physical access to a machine on the internal network, a tester can run a tool like Responder to poison LLMNR and NBT-NS broadcast requests, causing other hosts to authenticate to the attacker's machine and revealing NTLMv2 credential hashes. This works passively and does not require compromising the target laptop's OS directly. The captured hashes can then be cracked or relayed for further access.