search

login-securite / DonPAPI

Dumping DPAPI credz remotely
GNU General Public License v3.0
930 stars 110 forks source link

Cookie filtering #29

Closed tigre-bleu closed 1 year ago

tigre-bleu commented 2 years ago

At the moment, depending on the network a lot of expired cookies can be returned. It would be nice if the tool could filter out those (at least by default). In the same idea, a lot of cookies can be empty so 99.9% of the time useless, this could also be filtered out.

tigre-bleu commented 2 years ago

Something that could also help tremendously in large networks is to have the capability to export all cookies (and passwords) in a csv file. With that it would be easy to filter all credentials (cookies and/or passwords) available for a specific website for a specific user.

TAI-REx commented 2 years ago

I have the same ideas in my mind during red-team works with DonPAPI. Will be good - at least tern off grabbing cookie at all via flag --nocookie or smth like that. Because in auditing very big nets -> like 3-4k hosts -> report html-file will got wight 100-150mb and will crash any browser except text based ones. If I will got some more free time will make PR to fix that. Thx for awesome tool.

login-securite commented 1 year ago

the reports now generates multiple report files, with and without the cookies.