Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a Windows post‑exploitation credential‑harvesting tool that targets Chromium‑based and Gecko‑based browsers to extract saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks. It bypasses Chrome's App‑Bound Encryption (Chrome 127+) by launching a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, and uses DPAPI or NSS handling for other browsers; outputs are written as structured JSON for red‑team use. The report covers usage, evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), detection indicators (process injection, IElevator calls, headless browser instantiation, reads of browser SQLite DBs), and recommendations for mitigation (use of dedicated password managers, EDR monitoring of IElevator and headless processes).