Web Browsers
MITRE ATT&CK™ Credentials from Password Stores: Credentials from Web Browsers - Technique T1555.003
Last updated
Was this helpful?
MITRE ATT&CK™ Credentials from Password Stores: Credentials from Web Browsers - Technique T1555.003
Last updated
Was this helpful?
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
On UNIX-type systems, stored credentials are kept in firefox profile folders such as :
We may download the entire ~/.mozilla/firefox folder to our attacking machine and use to decrypt passwords.
On UNIX-type systems, stored credentials are kept in Google Chrome profile folders such as :
We may download the entire Default folder to our attacking machine and use to decrypt passwords. Not that the default script profile folder path should be edited.