Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly-available post-exploitation tool that harvests browser-stored credentials and session tokens from Chromium-based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox by using techniques including headless Chromium spawning, Early Bird APC DLL injection to leverage the IElevator COM interface (bypassing Chrome App-Bound Encryption), DPAPI key extraction, and NSS decryption for Firefox; it outputs structured JSON and includes evasion features such as string obfuscation, API hashing, PPID/argument spoofing, and file-handle duplication. The report details supported data types (cookies, saved logins, OAuth refresh tokens, credit cards, autofill, history, bookmarks), usage examples, attack scenarios demonstrating cloud account/session takeover, red team relevance, and detection/mitigation suggestions (monitor IElevator calls, detect unexpected headless browser processes and non-browser reads of browser SQLite DBs, and use external credential managers).