Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly described post-exploitation credential-harvesting tool that targets major Windows browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox). It bypasses Chrome’s App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, and handles DPAPI and NSS decryption for other browsers, extracting cookies, OAuth tokens, saved credentials, credit cards, autofill data, and history into JSON output. The report covers operational features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), usage scenarios for red teams and adversaries, detection opportunities (unexpected process injection, IElevator calls, reads of browser SQLite databases), and mitigation recommendations such as using dedicated password managers and monitoring browser-related behaviors.