SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells

DumpBrowserSecrets is a post-exploitation credential-harvesting tool for Windows that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries and browsing history from Chrome, Edge, Brave, Opera (and variants), Vivaldi, and Firefox. It bypasses Chrome’s App-Bound Encryption by launching a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, handles DPAPI and NSS decryption for other browsers, includes multiple evasion techniques, outputs structured JSON for red-team use, and includes detection and mitigation recommendations.