GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → defaultnamehere → Cookie_crimes

defaultnamehere / Cookie_crimes

Licence: mit
Read local Chrome cookies without root or decrypting

Programming Languages

python
139335 projects - #7 most used programming language

Labels

securitysecurity-toolscookies

Projects that are alternatives of or similar to Cookie crimes

Applicationinspector
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.
Stars: ✭ 3,873 (+792.4%)
Mutual labels:  security-tools
Otseca
Open source security auditing tool to search and dump system configuration. It allows you to generate reports in HTML or RAW-HTML formats.
Stars: ✭ 416 (-4.15%)
Mutual labels:  security-tools
Evilscan
NodeJS Simple Network Scanner
Stars: ✭ 428 (-1.38%)
Mutual labels:  security-tools
Adhrit
Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks.
Stars: ✭ 399 (-8.06%)
Mutual labels:  security-tools
Xss Listener
🕷️ XSS Listener is a penetration tool for easy to steal data with various XSS.
Stars: ✭ 414 (-4.61%)
Mutual labels:  security-tools
Deimosc2
DeimosC2 is a Golang command and control framework for post-exploitation.
Stars: ✭ 423 (-2.53%)
Mutual labels:  security-tools
Race The Web
Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.
Stars: ✭ 385 (-11.29%)
Mutual labels:  security-tools
Gosec
Golang security checker
Stars: ✭ 5,694 (+1211.98%)
Mutual labels:  security-tools
Eyeballer
Convolutional neural network for analyzing pentest screenshots
Stars: ✭ 416 (-4.15%)
Mutual labels:  security-tools
Chronicle
Public append-only ledger microservice built with Slim Framework
Stars: ✭ 429 (-1.15%)
Mutual labels:  security-tools
Telemetrysourcerer
Enumerate and disable common sources of telemetry used by AV/EDR.
Stars: ✭ 400 (-7.83%)
Mutual labels:  security-tools
Hellraiser
Vulnerability scanner using Nmap for scanning and correlating found CPEs with CVEs.
Stars: ✭ 413 (-4.84%)
Mutual labels:  security-tools
Steady
Analyses your Java and Python applications for open-source dependencies with known vulnerabilities, using both static analysis and testing to determine code context and usage for greater accuracy. https://eclipse.github.io/steady/
Stars: ✭ 423 (-2.53%)
Mutual labels:  security-tools
Huskyci
Performing security tests inside your CI
Stars: ✭ 398 (-8.29%)
Mutual labels:  security-tools
Appinfoscanner
一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。
Stars: ✭ 424 (-2.3%)
Mutual labels:  security-tools
Cerberus
一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能
Stars: ✭ 389 (-10.37%)
Mutual labels:  security-tools
0xsp Mongoose
a unique framework for cybersecurity simulation and red teaming operations, windows auditing for newer vulnerabilities, misconfigurations and privilege escalations attacks, replicate the tactics and techniques of an advanced adversary in a network.
Stars: ✭ 419 (-3.46%)
Mutual labels:  security-tools
Fireelf
fireELF - Fileless Linux Malware Framework
Stars: ✭ 435 (+0.23%)
Mutual labels:  security-tools
Hosthunter
HostHunter a recon tool for discovering hostnames using OSINT techniques.
Stars: ✭ 427 (-1.61%)
Mutual labels:  security-tools
Burpa
Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).
Stars: ✭ 427 (-1.61%)
Mutual labels:  security-tools
View All Similar Projects ➔

Chrome Cookie Extraction Without Root

This will print out a user's Chrome cookies. You don't need to have their password or be root to use it. nice nice nice nice nice.

If you are not the kind of person who regularly gets the ability to execute code on other people's computers, you probably don't care about this.

Features

  • Prints all Chrome cookies in sweet sweet JSON
  • Works without root or the user's password
  • Works on Windows, Linux, macOS
  • Actually also works on the Microsoft Edge browser
  • Get cookies fom any Chrome Profile
  • Never leaves you on read
  • Cooks a mean lasagna
  • Compiles to a single binary

Metasploit module

For ezmode #ethical #hacking, please direct your meterpreter session to https://github.com/rapid7/metasploit-framework/blob/9616a9f79de0b22bfd142f12affd74cecbbd4413/documentation/modules/post/multi/gather/chrome_cookies.md

Blog post

Read the full details at https://mango.pdf.zone/stealing-chrome-cookies-without-a-password

Installation

Requires Python3.6+ to run locally, but the binary it compiles to works anywhere.

 pip3 install -r requirements.txt

Usage

Windows and Linux

To run it locally:

   python cookie_crimes.py

This will print your Chrome cookies as JSON for the default profile. They're conveniently in the right format to be loaded into the EditThisCookie Chrome Extension

To compile to a single binary:

   make

Note that the binary created will be for the OS you run make on. There's no fancy cross-compiling magic going on here. You'll have to build this on the same OS as you're running it on.

macOS

Why is it different on macOS?

For whatever reason, running Chrome with --headless has allowed reading of cookies from normal ("headful") Chrome on-and-off over the last few years as changes to Chrome are made. Seriously there are so many commits every day that it's become difficult to say "Chrome does not have this feature". This has caused the headless method to sometimes not work on macOS.

How to do it

Instead, you can run:

./cookie_crimes_macos.sh
Formatting for EditThisCookie

Chrome's cookie format stores domains with leading dots (e.g. .google.com), and so to import all cookies into Chrome via the EditThisCookie Chrome Extension, you'll need to remove the leading dots. You can do this via the following Enterprise Grade and completely unnecessary bash script:

cat cookies.json | ./format_for_editthiscookie.sh
How it works

On macOS, remote debugging is enabled by quickly killing and restarting Chrome, and attaching remote debugging to the new Chrome session with --restore-last-session (Just like clicking "restore tabs" in Chrome). This does have the downside of making the Chrome window look like it crashed for about 0.5s (it did lol) and reloading all tabs. But hey, the user will probably just assume their Chrome crashed and restored itself.

Extra crispy thanks to @IAmMandatory for sharing this trick <3

cookie_crimes_macos.sh will also download, execute, and delete a websocat binary to make the websocket request.

Microsoft Edge

Listen I know that's not Chrome, but hear me out. Because Edge is based on Chromium, the same trick works. Here's a blog post by @wunderwuzzi23 with all the details.

Multiple Profiles

If you want to extract the Chrome cookies for a profile other than the Default profile, just edit the PROFILE variable in cookie_crimes.py. This uses some sneaky "writing to /tmp" tricks to trick Chrome into reading the cookies for us.

How it works

Headless Chrome and user-data-dir

Headless (no window is rendered) Chrome is allowed to specify a user-data-dir. This directory contains cookies, history, preferences, etc. By creating a new headless Chrome instance, and specifying the user-data-dir to be the same as the victim's, your headless Chrome instance will authenticate as the vicitm.

Remote debugging

From here, we just use a normal (but extremely forbidden and undocumented) feature of Chrome: the Remote Debugging protocol. This is how Chrome Developer Tools communicate with Chrome. Once your headless Chrome (with remote debugging enabled) instance is running, this code just executes remote debugging commands to print the user's cookies for all websites in plaintext.

You can fully control Chrome at this point, taking any action the user could take.

closing ceremony

don't do crimes with this please

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].