SharpChromium : .NET 4.0 CLR Project To Retrieve Chromium Data, Such As Cookies, History & Saved Logins

SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract:

  • Cookies (in JSON format)
  • History (with associated cookies for each history item)
  • Saved Logins

Note: All cookies returned are in JSON format. If you have the extension Cookie Editor installed, you can simply copy and paste into the “Import” section of this browser addon to ride the extracted session.

Advantages

This rewrite has several advantages to previous implementations, which include:

  • No Type compilation or reflection required
  • Cookies are displayed in JSON format, for easy importing into Cookie Editor.
  • No downloading SQLite assemblies from remote resources.
  • Supports major Chromium browsers (but extendable to others)

Usage

Usage:
.\SharpChromium.exe arg0 [arg1 arg2 …]

Arguments:
all – Retrieve all Chromium Cookies, History and Logins.
full – The same as ‘all’
logins – Retrieve all saved credentials that have non-empty passwords.
history – Retrieve user’s history with a count of each time the URL was
visited, along with cookies matching those items.
cookies [domain1.com domain2.com] – Retrieve the user’s cookies in JSON format.
If domains are passed, then return only
cookies matching those domains. Otherwise,
all cookies are saved into a temp file of
the format “”%TEMP%\$browser-cookies.json””

Examples

Retrieve cookies associated with Google Docs and Github

.\SharpChromium.exe cookies docs.google.com github.com

Retrieve history items and their associated cookies.

.\SharpChromium.exe history

Retrieve saved logins (Note: Only displays those with non-empty passwords):

.\SharpChromium.exe logins

Notes on the SQLite Parser

The SQLite database parser is slightly bugged. This is due to the fact that the parser correctly detects data blobs as type System.Byte[], but it does not correctly detect columns of type System.Byte[].

As a result, the byte arrays get cast to the string literal “System.Byte[]”, which is wrong. I haven’t gotten to the root of this cause, but as a quick and dirty workaround I have encoded all blob values as Base64 strings.

Thus if you wish to retrieve a value from a column whose regular data values would be a byte array, you’ll need to Base64 decode them first.

R K

Recent Posts

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

13 hours ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

14 hours ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

1 day ago

PPLBlade: Advanced Memory Dumping and Obfuscation Tool

PPLBlade is a powerful Protected Process Dumper designed to capture memory from target processes, hide…

2 days ago

HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities If you’re searching for an efficient…

2 days ago

Comments in Bash Scripts

What Are Bash Comments? Comments in Bash scripts, are notes in your code that the…

1 week ago