Using browsers cache to get passwords

[enmafia2]

Hi guys,
This is a simple tutorial on how to get the cache of the browsers and get the passwords form them. With this method you can get the passwords even if the user has logged out of their accounts. I have only tried this on windows.

First of all open task manager, use right click and click on create dump file.


Go to the directory that will pop up. Now search the .dmp file and open it with winhex.
You can download winhex for free (it won't be full version but it will be enough for our task).
https://www.x-ways.net/winhex/

When opened with winhex click on the red binoculars


Search "password" and the username, password and website will pop up.


It is very easy but will do the job. I didn't find the tutorial here so maybe someone who is new into this might like it.
Have fun!

[Hysteresis]

Dumping data from browsers and applications that make use of SSL can also reveal encryption keys, which is very useful in digital forensics.
Great post, thanks enmafia2.

[Insider]

Interesting trick! I used similar methods back in the day when whaling keyloggers for smtp credentials. But it never occured to me that I could do this with memory dump file for browsers and such. Thank you for the insight! I'll try this, luckily I have an old dumpfile in the past when my browser crashed. Hopefully I can restore my session :p

[hotmagnet]

Thats really cool and new for me. Thanks for sharing!

[Ultrocity]

Very cool thanks for the tutorial. Will definitely use in the future

[hack3rsp0t]

Hi @enmafia2

I tried this on chrome but it didn't worked out.

Then i checked for iExplorer it was working there.But back in days It works for chrome also.

Do you think they fixed this thing or somehow encrypted type password fields.

Btw Great post
This could really save a lot of time in certain situations.

Thanks for sharing

[enmafia2]

Hi @enmafia2

I tried this on chrome but it didn't worked out.

Then i checked for iExplorer it was working there.But back in days It works for chrome also.

Do you think they fixed this thing or somehow encrypted type password fields.

Btw Great post
This could really save a lot of time in certain situations.

Thanks for sharing

Yeah, apparently Google Chrome uses encryption now, but according to this blog post you can still dump the passwords with metasploit (tested 4/5/2018).
https://null-byte.wonderhowto.com/how-to...y-0183600/

I would personally test it, but to lazy to set everything up now x)

[w912442845]

Who can extract the Facebook database account password?

[enmafia2]

Who can extract the Facebook database account password?

I don't understand what you want, could you rephrase please?

[TheD0ctor]

I was thinking to do this recently and apparently is a lot easier than I thought. Interesting stuff man, thanks for sharing this knowledge