Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Google Chrome

Credential Dumping

Credentials & User Impersonation

Google Chrome is a cross-platform web browser with profiles that can store saved login records and session data. A profile's Login Data SQLite database can expose login metadata and password values; Chrome encrypts stored credentials on Windows and macOS, and on Linux when Secret Service or KWallet is available, while Linux storage is unencrypted if neither key store is available. Chrome 136+ ignores remote-debugging flags for the default data directory and requires a non-standard --user-data-dir, so the debugging example operates on a separate profile rather than the user's existing session.

Source

https://www.google.com/chrome/

Language

N/A

References

google.com developer.chrome.com support.google.com chromium.googlesource.com attack.mitre.org

+7 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER