smukx-DumpBrowserSecrets-rs/README.md

DumpBrowserSecrets

A Rust based browser secrets extraction tool for Windows. Extracts cookies, logins, credit cards, autofill data, history, bookmarks, and tokens from Chromium based browsers and Firefox.

Supported Browsers

Browser	Encryption	Data Extraction
Google Chrome	V10 (DPAPI) + V20 (App-Bound)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Microsoft Edge	V10 (DPAPI) + V20 (App-Bound)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Brave	V10 (DPAPI) + V20 (App-Bound)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Opera	V10 (DPAPI)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Opera GX	V10 (DPAPI)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Vivaldi	V10 (DPAPI)	Cookies, Logins, Credit Cards, Autofill, History, Bookmarks, Tokens
Firefox	NSS (PBES2/PBKDF2)	Cookies, Logins, Autofill, History, Bookmarks, Tokens

Credits

The C PoC was released by Maldev Academy and an amazing work by luci4.

What Rust brings to the table. Take an look at Advantage section [Why Rust].

Features

• V10 Decryption (DPAPI): Decrypts browser secrets protected by Windows Data Protection API
• V20 Decryption (App-Bound Encryption): Decrypts Chrome 127+ App-Bound encrypted data via IElevator COM interface
• DLL Injection: Early Bird APC injection into browser processes to extract encryption keys from memory
• PPID Spoofing: Spoofs parent process ID to appear as a legitimate browser child process during key extraction
• Handle Stealing: Enumerates system handles via NtQuerySystemInformation to duplicate file handles from running browser processes, bypassing file locks on active databases
• Firefox NSS Decryption: Extracts master key from key4.db using PBES2/PBKDF2-SHA256 and decrypts login credentials
• SQLite Extraction: Directly reads browser SQLite databases for cookies, logins, history, autofill, credit cards, bookmarks, and tokens
• Multi-Browser Support: Extract from 7 different browsers in a single run
• JSON Output: Saves all extracted data to structured JSON files

Requirements

• OS: Windows 10/11
• Rust: 1.70+ (For compilation or you can download the compiled release version)
• Privileges: Standard user for DPAPI (V10) decryption. SeDebugPrivilege (typically admin) recommended for handle stealing from running browser processes

Installation

Build from source

git clone https://git.smukx.site/smukx/DumpBrowserSecrets-rs.git
cd DumpBrowserSecrets-rs
cargo build --release

The build produces two artifacts in target/release/:

• dump_browser_secrets.exe -> Main extraction tool
• extract_chromium_secrets.dll -> DLL for App-Bound (V20) key extraction

Note

: Both files should be placed in the same directory for full functionality. The exe works standalone for V10 (DPAPI) decryption, but the DLL is required for V20 (App-Bound) cookie decryption on Chrome 127+, Edge, and Brave.

Usage

Basic Usage

# Extract from Chrome (default browser)
dump_browser_secrets.exe

# Extract from a specific browser
dump_browser_secrets.exe -b:chrome
dump_browser_secrets.exe -b:edge
dump_browser_secrets.exe -b:brave
dump_browser_secrets.exe -b:opera
dump_browser_secrets.exe -b:operagx
dump_browser_secrets.exe -b:vivaldi
dump_browser_secrets.exe -b:firefox

DLL Injection Mode

Injects the extraction DLL into a spawned browser process to retrieve App-Bound (V20) encryption keys. Required for decrypting V20-encrypted cookies on Chrome 127+, Edge, and Brave.

# Auto detect DLL in same directory
dump_browser_secrets.exe -b:edge -dll

# Specify custom DLL path
dump_browser_secrets.exe -b:chrome -dll:C:\path\to\extract_chromium_secrets.dll

PPID Spoofing

Spoofs the parent process ID during DLL injection so the spawned browser process appears to be a child of an existing browser instance.

dump_browser_secrets.exe -b:chrome -spoof

# Combine with DLL injection
dump_browser_secrets.exe -b:edge -spoof -dll

Entry Limits

By default, the tool extracts up to 16 entries per category. Use -e to change this.

# Extract up to 100 entries per category
dump_browser_secrets.exe -b:chrome -e:100

# Extract all entries (no limit)
dump_browser_secrets.exe -b:chrome -e:all
dump_browser_secrets.exe -b:chrome -all

Command Line Reference

Option	Description
-b:<browser>	Target browser: chrome, edge, brave, opera, operagx, vivaldi, firefox
-dll	Enable DLL injection for V20 key extraction (DLL must be in same directory as EXE)
-dll:<path>	Enable DLL injection with a custom DLL path
-spoof	Enable PPID spoofing during DLL injection
-e:<count>	Max entries per category (default: 16, use all for unlimited)
-all	Extract all entries, equivalent to -e:all
-?	Show help message

Note

: Options also accept / prefix (e.g., /b:chrome, /dll) for Windows-style arguments.

Output

Extracted data is saved as JSON files in the current directory:

chrome_secrets.json
edge_secrets.json
brave_secrets.json
opera_secrets.json
opera gx_secrets.json
vivaldi_secrets.json
firefox_secrets.json

Output Structure

{
  "browser": "Chrome",
  "cookies": [
    {
      "host": ".example.com",
      "name": "session_id",
      "value": "decrypted_value",
      "path": "/",
      "expires": "13370000000000000"
    }
  ],
  "logins": [
    {
      "url": "https://example.com/login",
      "username": "user@example.com",
      "password": "decrypted_password"
    }
  ],
  "credit_cards": [
    {
      "name": "John Doe",
      "number": "decrypted_card_number",
      "expiry": "12/2025",
      "nickname": null
    }
  ],
  "autofill": [
    {
      "name": "field_name",
      "value": "field_value"
    }
  ],
  "history": [
    {
      "url": "https://example.com",
      "title": "Example Page",
      "visits": 5,
      "last_visited": "13370000000000000"
    }
  ],
  "bookmarks": [
    {
      "name": "Example Bookmark",
      "url": "https://example.com",
      "date_added": "13370000000000000"
    }
  ],
  "tokens": [
    {
      "service": "discord",
      "token": "extracted_token"
    }
  ]
}

How It Works

Chromium Browsers (Chrome, Edge, Brave, Opera, Vivaldi)

1. Handle Stealing: Enumerates all system handles using NtQuerySystemInformation(SystemExtendedHandleInformation) to find and duplicate file handles held by the running browser process. This allows reading locked database files (Cookies, Login Data, etc.) without killing the browser.

2. Key Extraction: Reads the Local State JSON file to find encrypted keys.

   • V10 keys: Decrypted using Windows DPAPI (CryptUnprotectData), works for all Chromium browsers
   • V20 keys: Decrypted via DLL injection into the browser process, which calls the IElevator COM interface for App-Bound decryption (Chrome 127+, Edge, Brave)

3. DLL Injection: Uses Early Bird APC injection. It creates a suspended browser process, allocates memory for the DLL path, queues an APC to LoadLibraryW, then resumes the thread. The DLL extracts keys and writes them to a temp file for the EXE to read.

4. Data Decryption: Uses the extracted AES-256-GCM keys to decrypt cookie values, passwords, credit card numbers, and other encrypted fields from SQLite databases.

Firefox

1. Profile Discovery: Locates the Firefox profile directory, preferring profiles that contain both key4.db and logins.json.

2. Master Key Extraction: Parses the key4.db SQLite database to extract the encrypted master key. Decrypts it using PBES2 with PBKDF2-HMAC-SHA256, handling ASN.1 DER-encoded key structures.

3. Login Decryption: Reads logins.json and decrypts each credential using the master key with 3DES-CBC or AES-CBC.

4. Other Data: Reads cookies from cookies.sqlite, history/bookmarks from places.sqlite, and autofill from formhistory.sqlite, these are stored unencrypted in Firefox.

Project Structure

dump-secrets-rs/
├── Cargo.toml              # Workspace manifest
├── exe/                    # Main extraction binary
│   ├── Cargo.toml
│   └── src/
│       ├── main.rs         # CLI parsing and orchestration
│       ├── types.rs        # BrowserType enum and data structures
│       ├── crypto.rs       # DPAPI, AES-GCM, AES-CBC, PBKDF2
│       ├── browsers.rs     # Browser paths, registry lookup, DLL injection orchestration
│       ├── extraction.rs   # SQLite data extraction for all data types
│       ├── firefox.rs      # Firefox NSS key extraction and login decryption
│       ├── handles.rs      # Handle stealing, file caching, SeDebugPrivilege
│       ├── injection.rs    # Early Bird APC injection, PPID spoofing
│       └── keys.rs         # Encryption key retrieval (V10/V20)
└── dll/                    # Key extraction DLL (cdylib)
    ├── Cargo.toml
    └── src/
        └── lib.rs          # IElevator COM interface, key extraction, temp file IPC

Why Rust ?

• Memory Safety - No buffer overflows, use after free, or dangling pointers. Rust catches these at compile time. For a tool doing raw pointer math (handle enumeration, DLL injection, APC queuing), this matters a lot.

• Bundled SQLite - rusqlite with bundled feature compiles SQLite directly in. No external DLL dependency for database access.

• Audited Crypto - Using well maintained Rust crates (aes-gcm, cbc, pbkdf2) instead of hand rolled crypto. Less chances for annoying bugs.

• Easier to Build - cargo build --release and you're done. No dealing with MSVC project files, manual linking, or dependency hell. All crates pull automatically.

• Better Error Handling - Rust's Result/Option types force you to handle failures explicitly instead of silently ignoring bad return values.

• Modular Codebase - The Rust module system keeps things clean and organized. Adding a new browser or data type is straightforward.

The low level Windows API calls (DPAPI, NtQuerySystemInformation, APC injection) are the same syscalls under the hood. Rust doesn't make those faster or slower, it just makes the code around them safer and easier to maintain.

Disclaimer

This tool is intended for authorized security testing, research, and educational purposes only. Unauthorized access to browser data is illegal and author does not responsible for your cause.

License

MIT_LICENSE

Made with ❤️ by Smukx.E