Social Engineering Vulnerability Evaluation and Recommendation Project

DumpBrowserSecrets is a Windows post-exploitation tool that harvests browser-stored credentials and session tokens from Chromium-based and Gecko-based browsers by combining a compiled executable and a DLL; it bypasses Chrome's App-Bound Encryption (via spawning a headless Chromium process and using IElevator COM access with Early Bird APC DLL injection), extracts DPAPI or NSS-protected keys for other browsers, and outputs structured JSON. The report documents supported browsers and data types (saved logins, cookies, OAuth refresh tokens, credit cards, autofill, history), operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), an example attack scenario, detection opportunities, and mitigation recommendations.