Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a public post-exploitation tool that harvests browser-stored credentials (saved passwords, session cookies, OAuth refresh tokens, credit cards, autofill, history, bookmarks) from Chromium-based browsers and Firefox. It bypasses Chrome's App-Bound Encryption by injecting a DLL into a spawned headless Chromium process to call the IElevator COM interface (Early Bird APC injection) and retrieves DPAPI or NSS-protected secrets as needed; output is structured JSON. The report documents usage, evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), an attack scenario demonstrating cloud account takeover potential, and detection/mitigation recommendations.