[albyaty]

I am currently using a RAT, I am trying to get the cookies or login session for some victims but so far the cookie grabbing plugin that is intergrated in the RAT does not work.

Does anybody have any alternatives that I can use in this case? Will I have to use evilginx2? are there any other options?

if I already have access to the victim's PC, is it that hard to grab the cookie?

Thanks in advance for the help! 😁😁

[jinpingxi]

I am currently using a RAT, I am trying to get the cookies or login session for some victims but so far the cookie grabbing plugin that is intergrated in the RAT does not work.

Does anybody have any alternatives that I can use in this case? Will I have to use evilginx2? are there any other options?

if I already have access to the victim's PC, is it that hard to grab the cookie?

Thanks in advance for the help! 😁😁

If the program lets you download a file on the target machine, best bet would be to just send another rat that can cookie log.
Otherwise, you could just download everything in their chrome directory and then parse those cookies out yourself

[this.0xd]

I don't know much about RATing, but session ids can be grabbed from inside a browser easily. So if they're afk then you can grab it through that?

[kuebiko]

Some RAT's have reverse browser features. If not, you can try importing cookies into a browser that supports that kind of thing (e.g. Genesium). Using reverse proxy/a nearby IP address is also critical to bypass 2fa on most platforms that support it.

[albyaty]

If the program lets you download a file on the target machine, best bet would be to just send another rat that can cookie log.
Otherwise, you could just download everything in their chrome directory and then parse those cookies out yourself

I got the cookie file but chrome cookies are encrypted as far as I know so it is basically useless

[KalisiRAM]

Token grab or check the saved passwords and if they have 2FA try to sim jack

[D3adF00l]

The private key used for decryption is inside the host machine. So the cookies should be decrypted only in the host and then can be grabbed away. The private key should be not exportable.

The encryption is performed by using WinDPAPI so you should write a program that call the decryption function (should be CryptUnprotectData function (dpapi.h)) to decrypt cookies.

Remember, the private key is in the host machine... and Google is a good mate.