Timeline for How can you steal cookies from Chrome?
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2017 at 19:57 | comment | added | sinanspd | @Rasty I've been only in the security industry for a short while but I don't think there's a direct way to see the credentials by reading a file. The best approach is what elsadek mentioned. I doubt people who steal google credentials do it by extracting something from the browser. The most common way (which is mostly patched at this point) is XSS or some password change through CSRF maybe? But I would get most of the cases are some sort of password cracking or through some fake login page. If you could simply get the creds from the browser Google wouldn't be a security pioneer | |
| Mar 16, 2017 at 19:51 | comment | added | sinanspd | @elsadek I think they store the hashes of the credentials on the servers. So theoretically the credentials themselves are not stored anywhere :) | |
| Jan 14, 2017 at 22:45 | comment | added | elsadek | @Rasty Credentials stay only on the server, client are tracked with different set of data. | |
| Dec 16, 2016 at 10:08 | comment | added | inno15 | Sorry I really can't help you further. I'm not an expert about the internals of Chrome. As I said, probably some reverse engineering might be necessary to understand where google chrome stores all the needed files or if it performs some security check to prevent what you are trying to do. | |
| Dec 16, 2016 at 9:45 | comment | added | Rasty |
One more thing please. This time I "stole" the whole ~/.config/google-chrome but it didn't work either, does Chrome store some credentials in some other place?
|
|
| Dec 15, 2016 at 21:27 | comment | added | dwkd | love the reference to CTF <3 | |
| Dec 15, 2016 at 19:31 | comment | added | inno15 | Theorically you need to have all the configuration files that the chrome browser uses to handle it's authentication. To know exactly what you need, reverse engineering might be needed and even then there would probably be some security features that prevent it. If you manage to do that let me know, it'd be surely one hell of a vulnerability | |
| Dec 15, 2016 at 18:38 | comment | added | Rasty | I'm trying to figure what amount of information is needed to do that. | |
| Dec 15, 2016 at 18:30 | comment | added | inno15 | Let me understand. It seems you are basically trying to hack yourself (or someone or a user on your computer) and swap your chrome configurations (credentials + cookies) with those of another user? and so trick chrome believing you are another user? | |
| Dec 15, 2016 at 17:59 | comment | added | Rasty | thank you very much for your answer. But anyway, credentials are stored somewhere, where are they and is cookies and credentials enough to login with different account or does it have some additional security? also big thanks for providing CTF games challenge. | |
| Dec 15, 2016 at 17:49 | review | First posts | |||
| Dec 15, 2016 at 18:11 | |||||
| Dec 15, 2016 at 17:48 | history | answered | inno15 | CC BY-SA 3.0 |