Modern Session Hijacking by Living off the DevTools Protocol | SO-CON 26
Source: YouTube · SpecterOps · published Sep 15, 2026 · 33:52
Cedric of Outflank demonstrates how attackers with process-injection access can enable the Chrome DevTools Protocol (CDP) in a running Chromium browser, bypassing years of cookie-security hardening to hijack sessions 0:00-0:06, 6:12-6:14.
Key Takeaways:
• Chromium cookie security has steadily hardened: per-cookie AES encryption in Chromium 80, appbound (V20) encryption via a system-account elevation service in Chromium 127, and devicebound session credentials in Chromium 145 that render stolen cookies unusable elsewhere 2:42-3:14, 4:55-5:28.
• CDP offers domains for browser, page, network/fetch interception, runtime JS execution, and cookie dumping, but normally requires noisy remote-debugging launch flags—Chromium 136 blocks debugging the default profile, and enterprises can disable DevTools via group policy 7:07-8:02, 8:36-9:44.
• Injecting shellcode into Chrome and calling the static StartRemoteDebuggingServer function (constructing a fake server-socket-factory object with a chosen port) starts the DevTools server in a running browser, bypassing default-profile blocks, origin restrictions, and enterprise policies—after overcoming TLS, Control Flow Guard, and CFG shadow-stack hurdles 10:51-13:42, 14:45-15:12.
• History, bookmarks, and saved-password lists aren't directly exposed by CDP but can be scraped via hidden chrome:// pages and extension APIs like chrome.bookmarks.getTree and chrome.passwordsPrivate 17:56-19:33, 20:02-20:41.
• Plaintext passwords can be recovered without user interaction by coercing autofill via CDP: opening an off-screen window, emulating focus, dispatching synthetic mouse events, and rewriting the page with autocomplete enabled 21:33-24:00.
• The fetch domain enables full TLS man-in-the-middle without installing a CA certificate by routing victim requests through an upstream proxy like Burp Suite, and a reverse proxy lets operators piggyback on live victim sessions (e.g., Gmail, Office 365), defeating devicebound credentials and transparently reaching internal networks 24:46-27:08, 27:32-30:06, 30:21-31:33.
Even as cookie theft gets harder, attackers with process-injection access to a running browser can pivot to CDP-based session tunneling, credential recovery, and traffic interception—raising the bar for endpoint defense rather than eliminating the threat; internal chrome:// pages offer further unexplored abuse potential, such as desktop screenshot streaming via the feedback page 31:40-33:00.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Today we'll talk about modern session hijacking by living of the death tools protocol. My name is Cedric from Bhavan. I'm an offensive researcher and red teamr at outflank which is part of forra and [snorts] uh I basically do research around new offensive techniques and then try to weaponize those techniques turn them into tools that then can be used by other red teams. Uh so to hopefully make their life a little bit easier during their operations. Today we'll focus on the Chrome DevTools protocol or CDP in short. And uh it's a way to instrument, debug, inspect whatever is going on in the browser, specifically Chromium based browsers. So thinking of Opera, Brave browser, Edge and Chrome. And where we typically see this used is for example in browser automation frameworks like Selenium wher…