Karkinos – Beginner Friendly Penetration Testing Tool

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool designed to extract saved passwords, session cookies, OAuth refresh tokens, credit card data and browsing history from Chromium-based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface, uses DPAPI/NSS handling for other browsers, writes structured JSON output, and includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication). The report details attack scenarios, detection opportunities, and mitigations aimed at endpoint defenders and red team operators.