CAINE (Computer Aided INvestigative Environment)

DumpBrowserSecrets is a public post‑exploitation credential‑harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card numbers, autofill data and browsing history from major Chromium‑based and Firefox browsers on Windows. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface (Early Bird APC injection), handles DPAPI and NSS encryption models for other browsers, includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and is positioned as a red‑team tool for assessing credential exposure and EDR controls.