Web Application Vulnerability Scanner Evaluation Project

DumpBrowserSecrets is a precompiled Windows post‑exploitation tool that extracts browser-stored credentials (passwords, cookies, OAuth tokens, credit cards, autofill and history) from major browsers by decrypting App‑Bound Encryption or DPAPI/NSS-protected stores. It performs a headless Chromium spawn with Early Bird APC DLL injection to use the IElevator COM interface for key decryption (Chromium), directly handles DPAPI for some browsers and NSS for Firefox, includes evasive features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), outputs structured JSON, and is positioned for red-team assumed-breach testing while also being usable by malicious actors.