Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a public post-exploitation tool and red-team utility that extracts browser-stored secrets (saved logins, session cookies, OAuth tokens, credit card data, autofill, history, bookmarks) from Chromium-based and Firefox browsers on Windows. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, uses DPAPI extraction for some browsers and NSS handling for Firefox, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). The report details usage, extracted data types, an attacker scenario, detection points (unusual process injection, headless browser use, IElevator calls, reads of browser SQLite files), and mitigation recommendations (use external credential managers and EDRs that monitor IElevator/headless browser behavior).