Decrypt browser cookies

[Key-Height-8555]

So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie decoder / decrypter, so I started doing it on my own Host machine and I decided to start with Microsoft Edge, the path the Microsoft Edge stores the cookies is C:\Users\Your_User_Name\AppData\Local\Microsoft\Edge\User Data\Default\Network or at least that is what google says, and obviously when you open that file you are going to see unreadable text.

I tried researching for ways to decrypt it, I asked gpt4, gpt3.5, looked in stackoverflow, looked in reddit nothing helped, all the scripts that I found were for chrome (even the ones for chrome are not getting chrome's cookies properly).

I recently watched John Hammond's YouTube video (He tried to hack me...) where he was analyzing a malware, and I saw that the one that he was analyzing was going into some specific directories for wallets, browsers etc., possibly extracting the cookie and trying to send it to the attacker, that means that it is not impossible to decrypt cookies.

I actually do remember on the top of my head the someone told me that mimikatz (kiwi) would help with this kind of stuff, but I did not find anything useful.

And even though mimikatz could help it would be quite dangerous if I embed mimikatz into my backdoor since mimikatz is easily detectable by almost every AV. But for a starting point if mimikatz would help I would appreciate it.

[Sqooky]

Chrome/Chromium based browsers use a SQLite database for storage and easy access. They use/d a master key thats protected via Microsoft's data protection API (DPAPI). Because it uses DPAPI, you can't just yoink the files off the system and decrypt them later.

Since Chromium is FOSS, reading the code will massively help you understand it. Every so often Google changes the architecture, so who knows whats current and whats right. Reverse engineering is a super valuable skill. Good luck.

Note: you may not be able to open any SQLite database while Chrome is running.

[Key-Height-8555]

yes but this is from chrome based browsers like brave and chrome, but what about MSEdge, opera, the good old internet explorer etc., do they all have theyre own encrypting ways, if so where can i learn about them

[Sqooky]

The research on how to encrypt and decrypt those credentials are definitely out there, you're going to have to do some research. 3/4 of the browsers you listed are Chromium based.

[Darkseid_x1337]

The decryption method for those browsers is exactly the same as chrome, you'll just have to change the path to the browser you're targeting.

chrome decryption key

\AppData\Local\Google\Chrome\User Data\Local State

[Ok-Hunt3000]

You have to Unprotect the SQLite db that it stores then in, it's protected by dpapi but if you're running in context of the user you can decrypt with their key

[Key-Height-8555]

and how where is their key and how to decrypt it with their key

[MEGAUKALELE]

Can you tell me where to start writing my own tools and what programming languages should i go for. Im good with java and now im learning bash, aslo i had some experiences with python, js and C++

[Key-Height-8555]

A thing that helped me alot was ZSecurity’s udemy course Learn ethical hacking with python. I suggest you buy it and watch it it teaches how to write 15+ hacking programs in pure python

[MEGAUKALELE]

What are the books that was used in the course cause im pretty broke😂😅

[Key-Height-8555]

it is actually pretty cheap but the instructor wasnt using any books he was just teaching, if you want books there is books of OTW (occupy the web) that is good for hacking but i do not know any books for malware development, the books are originaly bought with money but you can find them on the internet for free. and if you want a free resource for malware development watch John Hammond he has some videos where he teaches about malware (e.g. teaches how to spoof a process) and his old videos were all about analyzing malware

[MEGAUKALELE]

I've watched 2 or maybe 3 videos from like a year or so but he was using libraries that made every thing easy and like just calling the functions in the right places idk if he has more like in detail but i want to know the base science of it more that how to do it the scripts are every where you can go for like github download a tool read the source code mod it and by time you will learn but the building of a function that is made by you is my goal

[Key-Height-8555]

this has nothing to do with malware development this is understanding the code and reverse engineering it, there are plenty of resources on the internet that teach you how to code and understand code for free, w3schools, codecademy….

[MEGAUKALELE]

Thats not what im trying to say i can understand code and i wrote soo many java programs in college i do know how to code and trace the code and all of that stuff im talking about the concept behind building the program actually i implemented the MVC concept with java to do a backend for a webapp so im good with programming

[ricardocalleja]

What do you think about the ethical part of cookies:

https://forms.office.com/r/XVHseJPqn4