Introduction
Modern browser-based operations are changing as Chromium introduces new protections designed to reduce cookie theft and session hijacking. This presentation explores the Chromeo tooling in OST. In it we discuss how Chrome DevTools Protocol (CDP) can be enabled within an already running Chromium-based browser, bypassing traditional command-line flag requirements and overcoming restrictions that limit access to existing browser profiles.
Execution
The session demonstrates how activating CDP within a live browser process provides far more than cookie access. Operators can inspect and interact with active browser sessions, enumerate open tabs, extract cookies, bookmarks, browsing history, and saved credential information, and execute actions against web applications through the victim’s browser. The presentation also examines recent Chromium security changes, including cookie encryption, app-bound encryption, and device-bound session credentials, and discusses how these protections have altered traditional browser theft techniques.
Through practical demonstrations, attendees will see how Chromium can be used to interact with active Microsoft 365 and Gmail sessions, access browser data and leverage browser pivoting to route requests through the victim’s browser. By executing requests from within the target browser context, operators can access authenticated resources, interact with live sessions, and reach internal web applications that would otherwise be inaccessible from an external system. Chromeo is implemented as a BOF and standalone Python tool.
