Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

SharpChromium

Noise: RESTRICTED_ACCESS_BLUR_MARKER

Credential Dumping

Credentials & User Impersonation

Host Enumeration

Windows C# utility targeting .NET Framework 4.0+ that reads the current user's Chromium Default profiles and extracts saved logins with non-empty decrypted passwords, cookies, and browsing history. Upstream documents Google Chrome, Microsoft Edge, and Edge Beta; source also checks a Brave profile path, but labels Brave as Edge in status and cookie-output names. Cookie-domain filters print matching cookie JSON to stdout; history and login records print to stdout; unfiltered cookies are written as JSON under %TEMP%. Decryption uses current-user DPAPI for legacy values and BCrypt AES-GCM for Chromium v10 data; the source does not implement App-Bound Encryption v20.

Source

https://github.com/djhohnstein/SharpChromium

Language

References

github.com github.com raw.githubusercontent.com raw.githubusercontent.com raw.githubusercontent.com

+11 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER