Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly documented post-exploitation tool that harvests browser-stored credentials and session tokens from major browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox). It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, uses DPAPI/NSS methods for other browsers, and outputs structured JSON of recovered cookies, OAuth refresh tokens, saved logins, credit card data, autofill entries, and history. The report details operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing), a rapid extraction attack scenario, and detection/mitigation recommendations such as monitoring IElevator calls, headless browser instantiation, and avoiding browser-based password storage.