In this demo,
we're going to look at getting credentials from browsers using LaZagne.
That's entry T1555.003 from the MITRE ATT&CK framework. Browsers
can be a real treasure trove of passwords if you've got access to a
machine that's been used as someone's main workstation. While
someone stores their credentials, it's great for the user.
Their passwords can be automatically filled by the browser.
The browser likely synchronizes those passwords across devices,
giving an even bigger usability win.
This comes at a heavy price for security though. Those passwords can be
accessed programmatically. We're going to start by opening Chrome to
see what we're likely to get from LaZagne.
Here on the Chrome settings under Auto‑fill, we can see passwords, and
clicking on that shows us a list of the passwords that are saved.
There's only one here.
These are the passwords that LaZagne can give us. Clicking on the menu,
we can see there's even an option to export them.
That means the browser already lets us get to them.
The usefulness here comes if we only have command line access to
a machine instead of viewing the graphical interface. If we
can't actually see the interface, then we can still use LaZagne
to get browser passwords.
Let's switch to our directory with the executable we created.
We'll start by seeing the options that LaZagne gives us.
We can see a very large list of browsers here, and the
most common ones are hiding in the list.
We can see Google Chrome in there and Edge.
There's also Firefox,
good old Internet Explorer, and we've also got some
privacy‑focused browsers in there too, like Brave. Let's target
the Google Chrome browser as we know it's there.
We can see the credentials that Chrome showed us, including the password.
It's worth repeating this command with Python just so
we're clear on the syntax there too.
It's almost exactly the same.
We'll go back up a directory and run that, and we see the same data.
It's fairly common to see more than one browser present on a machine.
So if we specify the browsers option, but don't
state a specific browser to target,
then we'll get results from all of the browsers that LaZagne can access.
We can see that Chrome and Edge are in use, both of them having a
password that LaZagne has collected. Going back to the directory
containing Python, we can see the syntax for that too.