The Penetration Testing & Vulnerability Research Toolkit

DumpBrowserSecrets is a publicly available post-exploitation tool that harvests browser-stored credentials and session tokens from major Chromium-based and Firefox browsers by using DLL injection into a headless Chromium process to bypass App-Bound Encryption (via the IElevator COM interface), and by extracting DPAPI or NSS-protected secrets for other browsers; it includes operational evasion features and outputs structured JSON suitable for red team use but also usable by malicious actors to enable cloud account takeover and lateral movement.