Browser Data Extractor

A comprehensive Windows-based tool for extracting and decrypting browser data from multiple Chromium-based and Firefox-based browsers.

⚠️ Important Notice

This tool is designed for legitimate security research, forensics, and authorized pentesting purposes only. Usage of this tool without proper authorization may be illegal. Users are responsible for complying with all applicable laws and regulations.

🎯 Features

Supported Browsers

Chromium-Based Browsers

• Google Chrome - Full cookie, password, and autofill extraction
• Brave - Complete data extraction with v20 decryption
• Microsoft Edge - Full support for all profiles
• Opera - Standard and GX editions supported
• Yandex Browser - Full data extraction
• Vivaldi - Complete profile support
• Chromium - Native chromium builds
• CentBrowser - Full support

Firefox-Based Browsers

• Mozilla Firefox - Cookie and password extraction
• Firefox Developer Edition - Full support
• Tor Browser - Profile data extraction

Data Extraction Capabilities

🔐 Password Extraction

• Decrypts stored login credentials
• Supports v20 encryption (latest Chrome/Edge encryption)
• Handles legacy DPAPI encryption
• Extracts username/password pairs with associated URLs

🍪 Cookie Extraction

• Retrieves all stored cookies
• Decrypts encrypted cookie values
• Exports in Netscape cookie format
• Preserves cookie attributes (secure, httponly, expiry)

📝 Autofill Data

• Extracts form autofill data
• Decrypts encrypted field values
• Captures name-value pairs from web forms

Advanced Decryption Features

V20 Encryption Support

The tool implements state-of-the-art decryption for Chrome's v20 encryption scheme:

• Flag 1: AES-256-GCM with hardcoded key
• Flag 2: ChaCha20-Poly1305 encryption
• Flag 3: LSASS impersonation with CNG decryption
• Legacy DPAPI: Backward compatibility support

Security Mechanisms

• LSASS Impersonation: Elevates privileges to decrypt app-bound keys
• CNG Integration: Windows Cryptography Next Generation API support
• DPAPI Unprotection: Data Protection API for legacy encryption
• Debug Privileges: SeDebugPrivilege for system-level access

🛠️ Technical Architecture

Key Components

1. Master Key Derivation

Local State → Encrypted Key → DPAPI Decrypt → Key Blob Parser → V20 Master Key

2. Database Processing

• Creates temporary copies of locked SQLite databases
• Prevents file access conflicts with running browsers
• Automatic cleanup of temporary files

3. Process Management

• Automatically terminates browser processes
• Uses psutil for cross-process termination
• Ensures clean database access

4. Multi-Profile Support

• Scans all browser profiles (Default, Profile 1, Profile 2, etc.)
• Processes each profile independently
• Organizes output by browser and profile

📦 Installation

Prerequisites

• Operating System: Windows 10/11 (64-bit)
• Python Version: Python 3.8 or higher
• Administrator Rights: Required for LSASS impersonation and process termination

Step-by-Step Installation

1. Clone the repository

git clone https://github.com/yanaksalvo/Browser-Data-Cookie-Extractor.git
cd browser-data-extractor

2. Install required dependencies

pip install -r requirements.txt

3. Verify installation

python main.py --help

🚀 Usage

Basic Usage

Important: This script must be run with Administrator privileges.

# Run as Administrator
python main.py

What Happens When You Run

1. Process Termination: All detected browser processes are closed
2. Key Extraction: Master keys are retrieved from each browser
3. Data Decryption: Passwords, cookies, and autofill data are decrypted
4. Archive Creation: All data is saved to output.zip
5. Logging: Detailed logs are written to browser_data_extractor.log

Output Structure

output.zip
├── decrypted_keys/
│   ├── chrome_master_key.txt
│   ├── brave_master_key.txt
│   ├── edge_master_key.txt
│   └── ...
├── chrome/
│   ├── Default/
│   │   ├── passwords.txt
│   │   ├── cookies.txt
│   │   └── auto_fills.txt
│   └── Profile 1/
│       ├── passwords.txt
│       ├── cookies.txt
│       └── auto_fills.txt
├── brave/
│   └── ...
├── edge/
│   └── ...
└── firefox/
    └── ...

🔧 Configuration

Browser Configuration

The tool uses a comprehensive browser configuration dictionary in BROWSERS. To add a new browser:

'browser_key': {
    'name': 'Browser Display Name',
    'data_path': r'AppData\Local\BrowserPath\User Data',
    'local_state': r'AppData\Local\BrowserPath\User Data\Local State',
    'process_name': 'browser.exe',
    'key_name': 'BrowserKeyName',
    'chromium_based': True
}

📊 Logging

The tool maintains detailed logs in browser_data_extractor.log:

• Process start/end times
• Administrator privilege status
• Browser processes killed
• Profiles processed
• Data extraction counts
• Errors and warnings

Log Levels

• INFO: Normal operations
• WARNING: Non-critical issues
• ERROR: Operation failures
• CRITICAL: Fatal errors

🔍 How It Works

Chromium-Based Browser Flow

1. Locate Local State File

   • Reads Local State JSON file
   • Extracts app_bound_encrypted_key or encrypted_key

2. Decrypt Master Key

   • DPAPI unprotection (system context)
   • DPAPI unprotection (user context)
   • Parse key blob structure
   • Derive final master key based on flag type

3. Extract Database Data

   • Copy locked SQLite databases to temp directory
   • Query passwords, cookies, autofill tables
   • Decrypt v20 encrypted values

4. Save Decrypted Data

   • Format data in human-readable format
   • Add to ZIP archive with organized structure

Firefox-Based Browser Flow

1. Locate Profile Directory

   • Scan Firefox profiles folder
   • Identify active profiles

2. Extract Cookies

   • Read cookies.sqlite directly
   • Export in Netscape format

3. Extract Passwords

   • Parse logins.json file
   • Extract encrypted credentials (Note: Full decryption requires NSS libraries)

🐛 Troubleshooting

Common Issues

"Must be run with administrator privileges"

Solution: Right-click Python/CMD and select "Run as Administrator"

"Process still running" errors

Solution: Manually close all browser instances before running

"Could not get master key" warnings

Solution: Browser may not be installed or has different file structure

Empty output.zip

Solution: Check browser_data_extractor.log for specific errors

🔒 Security Considerations

When Using This Tool

1. Authorization: Only use on systems you own or have explicit permission to test
2. Data Handling: Extracted data contains sensitive information - handle accordingly
3. Legal Compliance: Ensure compliance with local laws and regulations
4. Cleanup: Securely delete extracted data after analysis

Detection

This tool:

• Terminates browser processes (may trigger security software)
• Requires administrator privileges (logged by Windows)
• Accesses sensitive Windows APIs (may be monitored)
• Creates temporary files (leaves forensic traces)

📝 Technical Requirements

Python Modules

• windows: Windows API interactions
• pycryptodome: AES-GCM and ChaCha20 implementations
• psutil: Process management
• sqlite3: Database operations (built-in)
• ctypes: Windows DLL interactions (built-in)

Windows APIs Used

• NCrypt: CNG key decryption
• DPAPI: Data protection
• Token Impersonation: Privilege elevation
• Process Management: Browser termination

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📜 License

This project is provided for educational and authorized security research purposes only. Users are responsible for ensuring their use complies with all applicable laws.

⚖️ Legal Disclaimer

This software is provided "as is" without warranty of any kind. The authors are not responsible for any misuse or damage caused by this tool. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws.

🙏 Acknowledgments

• Chrome v20 encryption research community
• Windows PythonForWindows library maintainers
• Security researchers who documented browser encryption mechanisms

📧 Contact

For questions, issues, or security concerns, please open an issue on GitHub.

---

Version: 1.0.0
Last Updated: December 2025
Compatibility: Windows 10/11 (64-bit)