Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly available post-exploitation tool that extracts browser-stored secrets (saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks) from Chromium-based and Firefox browsers on Windows. It bypasses Chrome's App-Bound Encryption (Chrome 127+) by spawning a headless Chromium process, injecting a DLL via Early Bird APC, and using the IElevator COM interface to decrypt the app_bound_encrypted_key; it also retrieves DPAPI keys for Opera-family browsers and uses NSS decryption for Firefox. The tool includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), outputs structured JSON for red team use, and the report outlines detection opportunities (monitoring IElevator calls, unexpected process injection, headless browser instantiation, and non-browser reads of browser SQLite databases) and mitigations (use of external credential managers, EDR rules focused on the described behaviors).