Google Native Client Security/Hacking Contest

DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from Chromium-based and Firefox browsers by bypassing App-Bound Encryption (via injection into a headless Chromium process and use of the IElevator COM interface) and handling DPAPI/NSS models for other browsers; it includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication) and outputs structured JSON for rapid credential reuse, enabling fast lateral movement and cloud account takeover. The report includes a usage example, an attack scenario, detection opportunities (monitoring IElevator calls, unusual headless browser instantiation, reads of browser SQLite DBs by non-browser processes), and mitigation advice such as using external credential managers and EDR rules focused on the described behaviors.