browser-exploitation

Craft malicious extensions and abuse Chrome DevTools Protocol debug ports.

253|37|Updated Feb 22, 2026

Search Tags:#extension #exploitation #credentials #cdp #browser #profile extraction

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill browser-exploitation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: browser-exploitation
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/browser-exploitation
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill browser-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps penetration testers find and exploit vulnerabilities within browser-based attack surfaces, including malicious extension crafting, abusing exposed debug ports, and extracting sensitive data from browser profiles.

Core Features & Use Cases

Malicious Extension Crafting: Develop and deploy custom browser extensions (Manifest V2/V3) to interact with target environments or exfiltrate data.
Chrome DevTools Protocol (CDP) Abuse: Leverage exposed debug ports (e.g., 9222, 9229) to execute JavaScript, steal cookies, or read local files.
Browser Profile Extraction: Harvest credentials, cookies, and history from compromised host browser profiles (Chrome, Firefox).
Use Case: After gaining initial access to a host, use this Skill to extract saved browser credentials and cookies to pivot to other internal systems.

Quick Start

Use the browser-exploitation skill to attempt to extract cookies from the target's Chrome browser profile.

Frequently Asked Questions about browser-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract saved credentials and cookies from a compromised Chrome browser profile?▼

You can extract saved credentials and cookies from a compromised Chrome browser profile by performing browser profile extraction on Linux, Windows, and macOS systems. This post-exploitation technique harvests sensitive data to pivot to other internal systems.

How can I execute JavaScript on a target browser through an exposed debug port?▼

You can execute JavaScript on a target browser by abusing the Chrome DevTools Protocol (CDP) on exposed remote debugging ports like 9222 or 9229. This CDP abuse allows you to execute arbitrary JavaScript, steal active cookies, or read local files.

What is the best way to craft a malicious browser extension for data exfiltration?▼

Crafting custom Manifest V2 or V3 browser extensions is an effective way to interact with target environments and exfiltrate data. This technique targets extension upload endpoints to establish persistence and steal sensitive information.

Does browser exploitation work across different operating systems like Linux, Windows, and macOS?▼

Browser exploitation supports post-exploitation credential harvesting and sensitive data extraction from compromised host browser profiles across Linux, Windows, and macOS systems. This ensures consistent results regardless of the underlying operating system.

When do I need to use Chrome DevTools Protocol abuse during a penetration test?▼

You should use Chrome DevTools Protocol abuse during a penetration test when you discover exposed remote debugging ports like 9222 or 9229. This allows you to execute JavaScript, steal cookies, or read local files from the target browser.