JavaScript Web Application Security Testing Tool

DumpBrowserSecrets is a post‑exploitation browser credential-harvesting tool that targets Chromium- and Gecko-based browsers to extract saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and history. It bypasses Chrome’s App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL (Early Bird APC) to call the IElevator COM interface, retrieves DPAPI keys for some Chromium forks and uses NSS decryption for Firefox, includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and is intended for red team/assumed-breach testing but represents a high‑risk capability for real-world credential theft and cloud account takeover.