Acunetix WVS (Web Vulnerability Scanner) 7 Review

DumpBrowserSecrets is a publicly released post-exploitation tool that harvests browser-stored credentials and session data from major Chromium- and Gecko-based browsers on Windows. It implements an App-Bound Encryption bypass for Chrome/Edge/Brave by spawning a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, and it handles DPAPI and NSS decryption for other browsers; the tool outputs structured JSON, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), and is intended for red team/assumed-breach use but increases realistic risk of cloud/SaaS account takeover from compromised developer workstations.