Stealing Chrome cookies without a password
summary
New technique claims full-steal of Chrome session cookies without password or root when arbitrary code execution exists on the machine. It uses headless Chrome + --user-data-dir to load the real profile, enables DevTools remote debugging WebSocket, issues the Network.getAllCookies command to retrieve plaintext cookies, and ships as a Metasploit module plus an HTML/JS exfil kit. It works across platforms where Chrome supports remote debugging. Mitigation: block RCE, use channel‑bound cookies or server detection of cookie movement.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:42look at the forbidden data
- 7:23how do we steal cookies?
- 8:19why Chrome?
- 8:35Operation ACTUAL CRIMES
- 9:41does chrome have an API for viewing cookies?
- 11:44how does chrome decide i'm logged in?
- 21:582 years old
- 23:08Prevention
- 24:09Detection
- 25:32what did i learn?
- 27:01what does this have to do with python?
related talks
48mA Weakness In Chrome & A New Hacking Technique
56mCookieMonstruo: Apple Flavour
44mWhen you can't afford 0days: Client-side exploitation for the masses
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
34mBreaching the Perimeter via Cloud Synchronized Browser Settings
40mHow the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales
21mDeath to Cookies