WEBVTT

00:00:01.340 --> 00:00:02.140
In this demo,

00:00:02.140 --> 00:00:05.750
we're going to look at getting credentials from browsers using LaZagne.

00:00:06.540 --> 00:00:13.050
That's entry T1555.003 from the MITRE ATT&CK framework. Browsers

00:00:13.060 --> 00:00:17.050
can be a real treasure trove of passwords if you've got access to a

00:00:17.050 --> 00:00:21.570
machine that's been used as someone's main workstation. While

00:00:21.570 --> 00:00:24.720
someone stores their credentials, it's great for the user.

00:00:25.070 --> 00:00:28.160
Their passwords can be automatically filled by the browser.

00:00:29.140 --> 00:00:32.980
The browser likely synchronizes those passwords across devices,

00:00:33.090 --> 00:00:35.460
giving an even bigger usability win.

00:00:36.540 --> 00:00:41.290
This comes at a heavy price for security though. Those passwords can be

00:00:41.300 --> 00:00:46.150
accessed programmatically. We're going to start by opening Chrome to

00:00:46.150 --> 00:00:48.360
see what we're likely to get from LaZagne.

00:00:49.240 --> 00:00:54.400
Here on the Chrome settings under Auto‑fill, we can see passwords, and

00:00:54.400 --> 00:00:57.550
clicking on that shows us a list of the passwords that are saved.

00:00:58.540 --> 00:00:59.560
There's only one here.

00:01:00.440 --> 00:01:04.980
These are the passwords that LaZagne can give us. Clicking on the menu,

00:01:04.980 --> 00:01:07.660
we can see there's even an option to export them.

00:01:08.440 --> 00:01:11.260
That means the browser already lets us get to them.

00:01:12.140 --> 00:01:15.680
The usefulness here comes if we only have command line access to

00:01:15.680 --> 00:01:20.190
a machine instead of viewing the graphical interface. If we

00:01:20.190 --> 00:01:23.780
can't actually see the interface, then we can still use LaZagne

00:01:23.790 --> 00:01:25.160
to get browser passwords.

00:01:26.140 --> 00:01:29.560
Let's switch to our directory with the executable we created.

00:01:30.440 --> 00:01:33.260
We'll start by seeing the options that LaZagne gives us.

00:01:34.240 --> 00:01:37.630
We can see a very large list of browsers here, and the

00:01:37.630 --> 00:01:39.660
most common ones are hiding in the list.

00:01:40.340 --> 00:01:42.760
We can see Google Chrome in there and Edge.

00:01:43.640 --> 00:01:44.910
There's also Firefox,

00:01:45.110 --> 00:01:48.300
good old Internet Explorer, and we've also got some

00:01:48.300 --> 00:01:53.090
privacy‑focused browsers in there too, like Brave. Let's target

00:01:53.090 --> 00:01:55.760
the Google Chrome browser as we know it's there.

00:01:56.640 --> 00:02:00.450
We can see the credentials that Chrome showed us, including the password.

00:02:01.340 --> 00:02:04.440
It's worth repeating this command with Python just so

00:02:04.440 --> 00:02:06.350
we're clear on the syntax there too.

00:02:06.740 --> 00:02:08.360
It's almost exactly the same.

00:02:09.340 --> 00:02:14.260
We'll go back up a directory and run that, and we see the same data.

00:02:15.240 --> 00:02:18.960
It's fairly common to see more than one browser present on a machine.

00:02:19.540 --> 00:02:23.100
So if we specify the browsers option, but don't

00:02:23.100 --> 00:02:25.040
state a specific browser to target,

00:02:25.300 --> 00:02:29.160
then we'll get results from all of the browsers that LaZagne can access.

00:02:30.140 --> 00:02:34.430
We can see that Chrome and Edge are in use, both of them having a

00:02:34.430 --> 00:02:38.890
password that LaZagne has collected. Going back to the directory

00:02:38.890 --> 00:02:41.960
containing Python, we can see the syntax for that too.