Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly available post‑exploitation tool that extracts browser‑stored secrets (saved credentials, session cookies, OAuth refresh tokens, credit cards, autofill data, bookmarks, and history) from major Chromium‑based browsers and Firefox. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, handles DPAPI and NSS decryption for other browsers, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). Although aimed at red teams and outputs structured JSON, its capabilities enable rapid cloud account takeover and lateral movement on compromised developer endpoints and present a significant detection/mitigation challenge for enterprise EDR deployments.