Extract KeePass Passwords (2.x) From Database
ID: 001ca559-8b95-51cc-9fa2-e1dd25dfcfc1
STIX ID: report--001ca559-8b95-51cc-9fa2-e1dd25dfcfc1
Feed Name: Darknet
DumpBrowserSecrets is a publicly available post‑exploitation credential‑harvesting tool targeting Chromium‑ and Gecko‑based browsers on Windows. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, retrieves DPAPI or NSS‑protected secrets for other browsers, and extracts cookies, saved logins, OAuth refresh tokens, credit cards, autofill, history, and bookmarks into structured JSON; the tool includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, file‑handle duplication) and is intended for red team assumed‑breach testing but presents a high operational risk if misused.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
