Art.BrowserCookies
0.49.0
dotnet add package Art.BrowserCookies --version 0.49.0
NuGet\Install-Package Art.BrowserCookies -Version 0.49.0
<PackageReference Include="Art.BrowserCookies" Version="0.49.0" />
<PackageVersion Include="Art.BrowserCookies" Version="0.49.0" />
<PackageReference Include="Art.BrowserCookies" />
paket add Art.BrowserCookies --version 0.49.0
#r "nuget: Art.BrowserCookies, 0.49.0"
#:package Art.BrowserCookies@0.49.0
#addin nuget:?package=Art.BrowserCookies&version=0.49.0
#tool nuget:?package=Art.BrowserCookies&version=0.49.0
Art.BrowserCookies
Art.BrowserCookies provides rudimentary support for cookie extraction on select browsers. It is a part of the Art archival package set.
Browser Support
| Browser / Platform | Chrome | Edge |
|---|---|---|
| Windows | v10[1], v20[1], DPAPI[1] | v10[1], v20[1], DPAPI[1] |
| macOS | v10[2] | v10[2] |
[1] v10, v20, and DPAPI refer to cookie encryption types; v10 and v20 are used as prefixes with potentially browser-specific encryption procedures, while DPAPI refers to straightforward decryption as-is via Windows's Data Protection API
[2] v10 refers to a cookie encryption type; v10 is used as a prefix, with a key retrieved from Keychain
Elevation for Decryption
v20 cookies on Windows Chromium browsers go through the System account for encryption, and decryption requires a process to run under that account for the right DPAPI context. A helper Windows PowerShell (not PowerShell Core) script is embedded in this library which includes the Invoke-CommandAs library and a small job which will ultimately execute a decryption via the System account. Getting the job scheduled requires elevation to administrator, so the PowerShell process that runs the helper script is elevated which will trigger a UAC prompt if those are enabled.
v10 cookies on macOS go through Keychain, specifically via the security
CLI which accesses the browser's store in Keychain. This will trigger a privilege check with an option to
always allow the calling program access to that store. Do not select Always Allow, as the permissions are being granted to the security utility.
Resources
Windows v20 keys (runassu Python PoC)
Google Security Blog - Improving the security of Chrome cookies on Windows
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. net9.0 was computed. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Art (>= 0.49.0)
- Microsoft.Data.Sqlite (>= 10.0.2)
- System.Security.Cryptography.ProtectedData (>= 10.0.2)
-
net8.0
- Art (>= 0.49.0)
- Microsoft.Data.Sqlite (>= 10.0.2)
- System.Security.Cryptography.ProtectedData (>= 10.0.2)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Art.BrowserCookies:
| Package | Downloads |
|---|---|
|
Art.Http
Artifact retrieval toolkit (HTTP variants) |
|
|
Art.Tesler
Artifact retrieval toolkit (command-line support) |
GitHub repositories
This package is not used by any popular GitHub repositories.