Skip to content

Back to the catalog

uk_daniel_card
x.comthread

uk_daniel_card

A short first-person thread describing stealing credentials from a running system as an unprivileged userland process: sniffing the clipboard to grab passwords copied out of KeePass, scraping process memory and SQLite databases for stored passwords/usernames/tokens/cookies, hunting for files like password.txt, and reading Chrome/browser credentials straight out of RAM as they sit in cleartext in text boxes. The author's point is that once someone else's code is running on your machine, it's practically impossible to fully harden every surface — clipboard, memory, and disk are all exposed.

TL;DR Practitioner describes stealing KeePass/browser credentials from clipboard, process memory, and SQLite files as an ordinary userland process.
Open original ↗

Organisations named here

  • clipboard sniffing
  • credential theft from process memory

Technologies named here

  • KeePass
  • Chrome/browsers
  • SQL Lite databases
  • third party password managers
  • Chrome
  • SQLite

Techniques named here

  • Clipboard data theft
  • Process memory scraping
  • SQL Lite database extraction
  • Credential/token/cookie theft
  • File hunting for sensitive filenames

Related in Offensive Security