EdgeSavedPasswordsDumper
This tool was created to show that whenever a user stores credentials in Edge (using the Microsoft Password Manager feature, e.g. Autofill), ALL credentials are stored in plaintext in the parent Edge process memory. This is obviously problematic in a shared environment (e.g. on a terminal servers) as an attacker can access all Edge processes for all logged on and disconnected users, and dump their saved credentials. Microsoft has said that this is "by design" and thus won't fix this.
Powershell version: https://gist.github.com/gitgotgitgotit/e28e02a02a358aef189c9c1ee426adf8
Rust version: https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/Browser%20Creds%20Dumper/EdgeSavedPasswordsDumper
Post #7616
149
Forwarded from 1N73LL1G3NC3
