shaddy43
Not Working for latest version of chrome
Might be that closed issue with not proper handling of multiple accounts, you need to compile it from source code to make it work tho it seems without logged in chrome acc it can extract only logins
@malanalysis02, BrowserSnatch latest code is already tested on this version for Google Chrome.
For extracting cookies use admin cmd with parameter: BrowserSnatch -app-bound-decryption
For extracting passwords use the parameter: BrowserSnatch -pass -c
The last release is a few commits behind the latest code, which handles few issues like snatching data from multiple profiles.
@malanalysis02, BrowserSnatch latest code is already tested on this version for Google Chrome.
For extracting cookies use admin cmd with parameter: BrowserSnatch -app-bound-decryption
For extracting passwords use the parameter: BrowserSnatch -pass -c
The last release is a few commits behind the latest code, which handles few issues like snatching data from multiple profiles.
If you fresh install new version of chrome and save password , it cannot extract those password , but if the chrome is updated instead of fresh install its still working
@shaddy43 Reopen this issue, on a fresh install of chrome it cannot grab cookies or passwords using latest commit compiled from source
For a fresh install of Chrome, the app bound decryption key is different from before. BrowserSnatch is retrieving already extracted key from previous copy. A quick fix is to delete the NTUSER.DAT file in public folder. I will update the code to only retrieve the last key or delete NTUSER.dat after each usage depending on my requirements.
For the logins, I will look into it.
Update: The reason why snatching logins from Latest Chrome is failing is because those passwords are also now being encrypted with the app-bound-encryption key. To snatch these logins, i will have to redesign the code while keeping backward compatibility with previous versions of chrome and other chromium browsers.
I can try to work on and get a working PR today to solve this while keeping backwards compatibility, as I'd like this fixed ASAP :)
Google chrome passwords extraction resolved. Latest key extraction bug resolved.