# Meckazin/ChromeKatz

Dump cookies and credentials directly from Chrome/Edge process memory

Repository: https://github.com/Meckazin/ChromeKatz
Canonical: https://ross.abutalabs.com/products/chromekatz
Language: C
License: BSD-3-Clause
License Family: permissive
Last push: 2026-04-09T08:29:35+00:00

## Health v2 (maintenance only)
Score: 72/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 76, release rhythm 66, longevity 71
- inputs: {"age_days": 1000, "days_push": 146, "days_rel": 226, "gap_med": 19.0, "n_releases_24m": 9}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1495, forks 137 (observed 2026-08-28T04:04:53.098156+00:00)

## What it is
ChromeKatz is a set of offensive security tools (CookieKatz, ElevationKatz) written in C that dump cookies and decryption keys directly from the memory of Chromium-based browsers like Chrome and Edge. It ships as standalone executables, Cobalt Strike Beacon Object Files, and a minidump parser, including an injection mode to bypass App-Bound Encryption.

## Use cases
- dump cookies from chrome process memory
- extract edge browser cookies without touching disk
- bypass chrome app-bound encryption
- parse cookies offline from a browser minidump
- retrieve cookies from incognito or in-private sessions
- get chrome decryption key from the elevation service
- dump webview2 cookies from a running process

## When to choose
- you are a red team operator or pentester needing live session cookies from Chromium browsers on Windows
- you want to avoid touching on-disk cookie databases or needing DPAPI keys
- you need a BOF variant to run within a C2 agent
- you must analyze cookies offline from a captured minidump

## When to avoid
- you need a defensive or forensic auditing tool with logging and alerting
- you target 32-bit browser installations, which are unsupported
- you need partitioned (CHIPS) cookies, which are not currently dumped
- you want a cross-platform solution - this is Windows-only

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cryptography
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: credential-dumping, cookie-extraction, red-team, beacon-object-file, chromium, app-bound-encryption, minidump, offensive-security

## Member repositories
- Meckazin/ChromeKatz (main) score 72

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:53.098156+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:33:15.875854+00:00, confidence not recorded.
  - readme: https://github.com/Meckazin/ChromeKatz (fetched 2026-08-28T04:04:53.098156+00:00, sha bd9644a14674)
- Data as of 2026-08-30T08:39:29.467469+00:00.