OWASP APICheck – HTTP API DevSecOps Toolset

DumpBrowserSecrets is a publicly released post-exploitation tool and red-team utility for Windows that harvests browser-stored credentials (cookies, saved logins, OAuth refresh tokens, credit cards, autofill, history, bookmarks) from Chromium-based (Chrome, Edge, Brave, Opera-family, Vivaldi) and Firefox browsers. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, uses DPAPI/NSS decryption where applicable, includes operational evasion (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and provides detection and mitigation guidance.