Linux Enumeration & Privilege Escalation Tool
ID: 3a6595bd-17bb-5595-bf93-0bbdbb821aef
STIX ID: report--3a6595bd-17bb-5595-bf93-0bbdbb821aef
Feed Name: Darknet
**DumpBrowserSecrets** is a precompiled Windows post‑exploitation tool that harvests saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium browsers by spawning a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface, and decrypting on‑disk browser vaults; it also handles DPAPI and NSS models, produces structured JSON output, and includes evasion techniques to reduce EDR detection, making it useful for red teams and potentially dangerous if abused.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
