So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie decoder/decrypter, so I started doing it on my own Host machine and I decided to start with Microsoft Edge, the path the Microsoft Edge stores the cookies is C:\Users\Your_User_Name\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies or at least that is what google says, and obviously when you open that file you are going to see unreadable text.

I tried researching for ways to decrypt it, I asked gpt4, gpt3.5, looked in stackoverflow, looked in reddit nothing helped, all the scripts that I found were for chrome (even the ones for chrome are not getting chrome's cookies properly).

I recently watched John Hammond's YouTube video (He tried to hack me...) where he was analyzing a malware, and I saw that the one that he was analyzing was going into some specific directories for wallets, browsers etc., possibly extracting the cookies and trying to send it to the attacker, that means that it is not impossible to decrypt cookies.

I actually do remember on the top of my head the someone told me that mimikatz (kiwi) would help with this kind of stuff, but I did not find anything useful.

And even though mimikatz could help it would be quite dangerous if I embed mimikatz into my backdoor since mimikatz is easily detectable by almost every AV. But for a starting point if mimikatz would help I would appreciate it.

So my question is how can I decrypt browser Cookies into JSON format that would be accepted by the "Cookie-Editor" extension.

  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – LvB
    Aug 16 at 12:21
  • Edited my question, please check it now Aug 16 at 12:24
  • 1
    Have you done any recon on what the Cookies file actually is? maybe you should try and figure out first what the file is... like using the file command on a Linux (wsl ftw). I suspect (with reason) its a type of datastore.
    – LvB
    Aug 16 at 12:59
  • also are you aware of this gist? gist.github.com/creachadair/937179894a24571ce9860e2475a2d2ec it should help with understanding whats going on.
    – LvB
    Aug 16 at 13:18
  • Well they are SQLite as you can see in here: ┌──(root㉿kali)-[/opt] └─# file Cookies Cookies: SQLite 3.x database, last written using SQLite version 3041002, file counter 53554, database pages 332, 1st free page 323, free pages 8, cookie 0x1b, schema 4, UTF-8, version-valid-for 53554 Aug 16 at 16:45


You must log in to answer this question.

Browse other questions tagged .