Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool (intended for red teams) that extracts saved passwords, session cookies, OAuth refresh tokens, credit cards, autofill data, and browsing history from major browsers on Windows. It supports Chromium-based browsers (Chrome, Edge, Brave) by bypassing App‑Bound Encryption through spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface, handles DPAPI for Opera/Vivaldi, and uses NSS for Firefox; output is structured JSON. The report covers operational evasion techniques, example attack scenarios, detection opportunities (e.g., unexpected process injection, IElevator calls, headless browser instantiation, reads of Login Data/Cookies/Web Data SQLite files), and mitigations such as using external credential managers and EDR detections focused on the IElevator interface.