+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Pulling passwords from Browser Memory. ALWAYS CLOSE YOUR BROWSER (/showthread.php?tid=5531642)
Pulling passwords from Browser Memory. ALWAYS CLOSE YOUR BROWSER - Mr. Robot - Jan 23, 2017
This will show you the password is in that dump file of their current browsing session.
How is this handy? Maybe the user doesn't/hasn't closed their browser but don't save their passwords. You can create a dump and examine it later.
To actually search the phrase "Password" you will need to purchase the full version or use another tool, otherwise you will need to type in a password you used during that session for proof it works.
The best part is it works on any site, doesn't matter if you type it in or it's autifilled - anyone who uses a browser before you is vulnerable even if their password isn't saved and they logged out after you are done.
wxHexEditor or use https://hexed.it/ and just uploaded the .DMP file.
Create a dump file of your current browsing session.
![[Image: ZQXrOAo.png]](https://i.imgur.com/ZQXrOAo.png)
Download and open WinHex (would be best to buy it)
Copy the dump file you made from task manager - located in
C:\Users\(username)\AppData\Local\Temp\File.DMP
Copy that file .DMP to your desktop or to another location. Open it using WinHex
![[Image: LSmn9EZ.png]](https://i.imgur.com/LSmn9EZ.png)
Open red binoculars and then type in a password you used during that browsing session - for example go to a random site, make an account or sign in. Try http://ebay.com/ maybe.
![[Image: KNK36Eb.png]](https://i.imgur.com/KNK36Eb.png)
![[Image: rWBvWWd.png]](https://i.imgur.com/rWBvWWd.png)
Password I just tested on Primedice
https://primedice.com/play
![[Image: YXf9lEf.png]](https://i.imgur.com/YXf9lEf.png)
Or use https://hexed.it/
![[Image: 8wSBC97.png]](https://i.imgur.com/8wSBC97.png)
* - DevNet - Jan 23, 2017
Does this also dump passwords submitted in incognito mode or the mozilla equivalent?
* - Papa Cuda - Jan 23, 2017
(Jan 23, 2017 08:02 AM)DevNet Wrote: Does this also dump passwords submitted in incognito mode or the mozilla equivalent?
Incognito mode doesn't save any cookies or data. Some data, like cookies, may be kept for the duration of the private browsing session and immediately discarded when you close your browser
* - Mr. Robot - Jan 23, 2017
(Jan 23, 2017 08:02 AM)DevNet Wrote: Does this also dump passwords submitted in incognito mode or the mozilla equivalent?
Sure does if it's open when you dump the process.
![[Image: xRH4iKt.png]](https://i.imgur.com/xRH4iKt.png)
* - Malicious007 - Jan 23, 2017
thanks buddy , nice tutorial ;)
* - Papa Cuda - Jan 23, 2017
(Jan 23, 2017 08:08 AM)Mr. Robot Wrote: Sure does if it's open when you dump the process.
Mind = blown.
I'll just go back to my hole. Thanks for teaching me something Robot
* - Imbue - Jan 23, 2017
That's really cool, I thought the browsers would do something to ensure these aren't available in memory. Especially so easily!
Thanks for the share.
* - SUI-3183372 - Jan 23, 2017
FF dump @ 2.2gb. Cannot be bothered opening that file -.-
* - Mr. Robot - Jan 23, 2017
(Jan 23, 2017 08:16 AM)Previously Known As.... Wrote: FF dump @ 2.2gb. Cannot be bothered opening that file -.-
Lol there are other tools to do it of course :)
I just thought I would make this quick lil tut because I never see people using this sort of thing.
* - Anubis - Jan 23, 2017
Thanks for sharing this. Nice tutorial. Keep it up.
* - Mr. Robot - Jan 23, 2017
Tested this on tor browser - it works
* - Mr. Robot - Jan 24, 2017
Anyone else got some shit to add?
* - ZuGgY - Jan 24, 2017
Mr. Robot back at it again with another useful tutorial.
* - Fυcĸleѕѕ - Jan 24, 2017
Nice one dad. Thanks for the share.
* - Lucifer's Inferno - Jan 24, 2017
I've tried messing about with this sort of stuff myself. How long does this temporary data exist for? Is it really just until the browser closes?
Works on more than just FFox?