# DumpBrowserSecrets

![Bannner](./image/banner.jpg)

A Rust based browser secrets extraction tool for Windows. Extracts cookies, logins, credit cards, autofill data, history, bookmarks, and tokens from Chromium based browsers and Firefox.


## Supported Browsers

| Browser | Encryption | Data Extraction |
|---------|-----------|-----------------|
| Google Chrome | V10 (DPAPI) + V20 (App-Bound) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Microsoft Edge | V10 (DPAPI) + V20 (App-Bound) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Brave | V10 (DPAPI) + V20 (App-Bound) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Opera | V10 (DPAPI) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Opera GX | V10 (DPAPI) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Vivaldi | V10 (DPAPI) | Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens |
| Firefox | NSS (PBES2/PBKDF2) | Cookies, Logins, Autofill, History, Bookmarks, Tokens |

## Credits 

The C PoC was released by [Maldev Academy](https://github.com/Maldev-Academy/DumpBrowserSecrets) and an amazing work by [luci4](https://x.com/GigelV41464).

What Rust brings to the table. Take an look at [Advantage section [Why Rust]](#why-rust-). 


## Features

- **V10 Decryption (DPAPI)**: Decrypts browser secrets protected by Windows Data Protection API
- **V20 Decryption (App-Bound Encryption)**: Decrypts Chrome 127+ App-Bound encrypted data via IElevator COM interface
- **DLL Injection**: Early Bird APC injection into browser processes to extract encryption keys from memory
- **PPID Spoofing**: Spoofs parent process ID to appear as a legitimate browser child process during key extraction
- **Handle Stealing**: Enumerates system handles via `NtQuerySystemInformation` to duplicate file handles from running browser processes, bypassing file locks on active databases
- **Firefox NSS Decryption**: Extracts master key from `key4.db` using PBES2/PBKDF2-SHA256 and decrypts login credentials
- **SQLite Extraction**: Directly reads browser SQLite databases for cookies, logins, history, autofill, credit cards, bookmarks, and tokens
- **Multi-Browser Support**: Extract from 7 different browsers in a single run
- **JSON Output**: Saves all extracted data to structured JSON files

## Requirements

- **OS**: Windows 10/11
- **Rust**: 1.70+ (For compilation or you can download the compiled release version)
- **Privileges**: Standard user for DPAPI (V10) decryption. SeDebugPrivilege (typically admin) recommended for handle stealing from running browser processes

## Installation

### Build from source

```bash
git clone https://git.smukx.site/smukx/DumpBrowserSecrets-rs.git
cd DumpBrowserSecrets-rs
cargo build --release
```

The build produces two artifacts in `target/release/`:
- `dump_browser_secrets.exe` ->  Main extraction tool
- `extract_chromium_secrets.dll` -> DLL for App-Bound (V20) key extraction

<br>

> **Note**: Both files should be placed in the same directory for full functionality. The exe works standalone for V10 (DPAPI) decryption, but the DLL is required for V20 (App-Bound) cookie decryption on Chrome 127+, Edge, and Brave.

## Usage

### Basic Usage

```bash
# Extract from Chrome (default browser)
dump_browser_secrets.exe

# Extract from a specific browser
dump_browser_secrets.exe -b:chrome
dump_browser_secrets.exe -b:edge
dump_browser_secrets.exe -b:brave
dump_browser_secrets.exe -b:opera
dump_browser_secrets.exe -b:operagx
dump_browser_secrets.exe -b:vivaldi
dump_browser_secrets.exe -b:firefox
```

### DLL Injection Mode

Injects the extraction DLL into a spawned browser process to retrieve App-Bound (V20) encryption keys. Required for decrypting V20-encrypted cookies on Chrome 127+, Edge, and Brave.

```bash
# Auto detect DLL in same directory
dump_browser_secrets.exe -b:edge -dll

# Specify custom DLL path
dump_browser_secrets.exe -b:chrome -dll:C:\path\to\extract_chromium_secrets.dll
```

### PPID Spoofing

Spoofs the parent process ID during DLL injection so the spawned browser process appears to be a child of an existing browser instance.

```bash
dump_browser_secrets.exe -b:chrome -spoof

# Combine with DLL injection
dump_browser_secrets.exe -b:edge -spoof -dll
```

### Entry Limits

By default, the tool extracts up to 16 entries per category. Use `-e` to change this.

```bash
# Extract up to 100 entries per category
dump_browser_secrets.exe -b:chrome -e:100

# Extract all entries (no limit)
dump_browser_secrets.exe -b:chrome -e:all
dump_browser_secrets.exe -b:chrome -all
```

### Command Line Reference

| Option | Description |
|--------|-------------|
| `-b:<browser>` | Target browser: `chrome`, `edge`, `brave`, `opera`, `operagx`, `vivaldi`, `firefox` |
| `-dll` | Enable DLL injection for V20 key extraction (DLL must be in same directory as EXE) |
| `-dll:<path>` | Enable DLL injection with a custom DLL path |
| `-spoof` | Enable PPID spoofing during DLL injection |
| `-e:<count>` | Max entries per category (default: `16`, use `all` for unlimited) |
| `-all` | Extract all entries, equivalent to `-e:all` |
| `-?` | Show help message |

> **Note**: Options also accept `/` prefix (e.g., `/b:chrome`, `/dll`) for Windows-style arguments.

## Output

Extracted data is saved as JSON files in the current directory:

```
chrome_secrets.json
edge_secrets.json
brave_secrets.json
opera_secrets.json
opera gx_secrets.json
vivaldi_secrets.json
firefox_secrets.json
```

### Output Structure

```json
{
  "browser": "Chrome",
  "cookies": [
    {
      "host": ".example.com",
      "name": "session_id",
      "value": "decrypted_value",
      "path": "/",
      "expires": "13370000000000000"
    }
  ],
  "logins": [
    {
      "url": "https://example.com/login",
      "username": "user@example.com",
      "password": "decrypted_password"
    }
  ],
  "credit_cards": [
    {
      "name": "John Doe",
      "number": "decrypted_card_number",
      "expiry": "12/2025",
      "nickname": null
    }
  ],
  "autofill": [
    {
      "name": "field_name",
      "value": "field_value"
    }
  ],
  "history": [
    {
      "url": "https://example.com",
      "title": "Example Page",
      "visits": 5,
      "last_visited": "13370000000000000"
    }
  ],
  "bookmarks": [
    {
      "name": "Example Bookmark",
      "url": "https://example.com",
      "date_added": "13370000000000000"
    }
  ],
  "tokens": [
    {
      "service": "discord",
      "token": "extracted_token"
    }
  ]
}
```

## How It Works

### Chromium Browsers (Chrome, Edge, Brave, Opera, Vivaldi)

1. **Handle Stealing**: Enumerates all system handles using `NtQuerySystemInformation(SystemExtendedHandleInformation)` to find and duplicate file handles held by the running browser process. This allows reading locked database files (Cookies, Login Data, etc.) without killing the browser.

2. **Key Extraction**: Reads the `Local State` JSON file to find encrypted keys.
   - **V10 keys**: Decrypted using Windows DPAPI (`CryptUnprotectData`), works for all Chromium browsers
   - **V20 keys**: Decrypted via DLL injection into the browser process, which calls the `IElevator` COM interface for App-Bound decryption (Chrome 127+, Edge, Brave)

3. **DLL Injection**: Uses Early Bird APC injection. It creates a suspended browser process, allocates memory for the DLL path, queues an APC to `LoadLibraryW`, then resumes the thread. The DLL extracts keys and writes them to a temp file for the EXE to read.

4. **Data Decryption**: Uses the extracted AES-256-GCM keys to decrypt cookie values, passwords, credit card numbers, and other encrypted fields from SQLite databases.

### Firefox

1. **Profile Discovery**: Locates the Firefox profile directory, preferring profiles that contain both `key4.db` and `logins.json`.

2. **Master Key Extraction**: Parses the `key4.db` SQLite database to extract the encrypted master key. Decrypts it using PBES2 with PBKDF2-HMAC-SHA256, handling ASN.1 DER-encoded key structures.

3. **Login Decryption**: Reads `logins.json` and decrypts each credential using the master key with 3DES-CBC or AES-CBC.

4. **Other Data**: Reads cookies from `cookies.sqlite`, history/bookmarks from `places.sqlite`, and autofill from `formhistory.sqlite`, these are stored unencrypted in Firefox.

## Project Structure

```
dump-secrets-rs/
├── Cargo.toml              # Workspace manifest
├── exe/                    # Main extraction binary
│   ├── Cargo.toml
│   └── src/
│       ├── main.rs         # CLI parsing and orchestration
│       ├── types.rs        # BrowserType enum and data structures
│       ├── crypto.rs       # DPAPI, AES-GCM, AES-CBC, PBKDF2
│       ├── browsers.rs     # Browser paths, registry lookup, DLL injection orchestration
│       ├── extraction.rs   # SQLite data extraction for all data types
│       ├── firefox.rs      # Firefox NSS key extraction and login decryption
│       ├── handles.rs      # Handle stealing, file caching, SeDebugPrivilege
│       ├── injection.rs    # Early Bird APC injection, PPID spoofing
│       └── keys.rs         # Encryption key retrieval (V10/V20)
└── dll/                    # Key extraction DLL (cdylib)
    ├── Cargo.toml
    └── src/
        └── lib.rs          # IElevator COM interface, key extraction, temp file IPC
```

## Why Rust ?

- **Memory Safety** - No buffer overflows, use after free, or dangling pointers. Rust catches these at compile time. For a tool doing raw pointer math (handle enumeration, DLL injection, APC queuing), this matters a lot.
  
- **Bundled SQLite** - `rusqlite` with `bundled` feature compiles SQLite directly in. No external DLL dependency for database access.

- **Audited Crypto** - Using well maintained Rust crates (`aes-gcm`, `cbc`, `pbkdf2`) instead of hand rolled crypto. Less chances for annoying bugs.

- **Easier to Build** - `cargo build --release` and you're done. No dealing with MSVC project files, manual linking, or dependency hell. All crates pull automatically.

- **Better Error Handling** - Rust's `Result`/`Option` types force you to handle failures explicitly instead of silently ignoring bad return values.

- **Modular Codebase** - The Rust module system keeps things clean and organized. Adding a new browser or data type is straightforward.

The low level Windows API calls (DPAPI, NtQuerySystemInformation, APC injection) are the same syscalls under the hood. Rust doesn't make those faster or slower, it just makes the code around them safer and easier to maintain.

## Disclaimer

This tool is intended for authorized security testing, research, and educational purposes only. Unauthorized access to browser data is illegal and author does not responsible for your cause.

## License

[MIT_LICENSE](./LICENSE)

Made with ❤️ by [Smukx.E](https://x.com/5mukx)