Meckazin/ChromeKatz

Free

Dump cookies and credentials directly from Chrome/Edge process memory

FreeFree tier

Type

Open Source

Visit Website GitHub (38 stars)

About Meckazin/ChromeKatz

ChromeKatz is a suite of tools for extracting sensitive information from the memory of Chromium-based browsers (Chrome, Edge, and Msedgewebview2). It includes CookieKatz for dumping cookies (including from incognito/private processes), CredentialKatz (currently deprecated), and ElevationKatz for obtaining the browser's decryption key via the elevation service. CookieKatz can operate as a standalone PE executable, a Beacon Object File (BOF) for Cobalt Strike, or a minidump parser for offline analysis. A new /inject flag enables bypassing App-Bound Encryption on modern browsers. The tool requires no DPAPI keys and avoids touching on-disk database files. Note: 32-bit browser installations are not supported, and partitioned cookies are not yet dumped.

Key Features

Dump cookies from Chrome, Edge, and Msedgewebview2 process memory

Dump credentials and obtain decryption keys via ElevationKatz

Supports incognito/private browsing mode cookie extraction

No DPAPI keys required; avoids touching on-disk cookie database

Parse cookies offline from a minidump file

Inject mode (/inject flag) to defeat App-Bound Encryption

Available as PE executable, Beacon Object File (BOF), and minidump parser

Robust method for finding cookies supports older browser versions

Pros & Cons

Pros

Dumps cookies from incognito/private browsing sessions
Works with minidump files for offline analysis
No DPAPI keys or touching on-disk database files required
Supports injection to bypass modern Chrome App-Bound Encryption
Access cookies of other users' browsers when running elevated
Provides BOF and executable variants for different deployment scenarios

Cons

Only regular cookies dumped; partitioned cookies not supported
32-bit browser installations are not supported
CredentialKatz component is currently deprecated
Requires elevated privileges for most functionality
Limited to Chromium-based browsers (Chrome, Edge, Webview)

Best For

Red team operations for cookie theft from Chromium browsersPenetration testing to extract session tokens and credentialsForensic analysis of browser memory dumpsPost-compromise credential harvesting from elevated processesBypassing App-Bound Encryption for cookie extraction

FAQ

Does ChromeKatz support dumping cookies from incognito mode?

Yes, CookieKatz can dump cookies from Chrome's Incognito and Edge's In-Private processes because browsers load all cookies into memory on startup.

What browsers are supported?

Chrome, Edge, and Msedgewebview2 are supported. 32-bit installations are not supported.

Can ChromeKatz bypass App-Bound Encryption?

Yes, by using the /inject flag in CookieKatz, you can defeat App-Bound Encryption on relevant browsers.

Does ChromeKatz require DPAPI keys?

No, DPAPI keys are not needed because cookies are decrypted directly from memory without touching the on-disk database.

Can I analyze cookies offline from a memory dump?

Yes, the CookieKatzMinidump component allows parsing cookies from a minidump file.