CookieX 🍪

CookieX is a red and purple team utility designed for ethical simulation of browser session exfiltration, encryption, and replay on compromised endpoints. Built for use in training labs, detection engineering, and adversary emulation environments.

---

⚙️ Purpose

CookieX allows operators to:

• Extract session cookies and tokens from user-installed browsers
• Encrypt and store session data in a portable vault file
• Replay or inject sessions into operator environments for analysis
• Simulate realistic post-exploitation behavior for purple team exercises

The tool is intended to support multi-platform usage, including:

• ✅ Windows
• ✅ macOS (Linux planned)

And the following browsers:

• 🟢 Chromium-based:
  • Chrome
  • Edge
  • Brave
  • Opera
• 🟣 Gecko-based:
  • Firefox
• 🍎 Apple WebKit:
  • Safari (planned, limited support due to AppleKeychain)

---

🔒 Ethical Use Only

CookieX is provided strictly for ethical and legal use cases, including:

• 🧪 Controlled lab and training environments
• 🛡 Authorized red team engagements
• 📚 Education and research

Any unauthorized use of this tool to access private user sessions without consent is strictly prohibited.

---

🧰 Features

• Chrome/Brave/Edge cookie extraction via DPAPI (Windows)
• Encrypted session storage (sessions.enc)
• Firefox support (cross-platform via SQLite)
• Safari/macOS Keychain parsing (in progress)
• Session replay loader (for authenticated environments)
• Optional exfil and C2 callback module (lab-safe only)
• SE overlays / fake UI (resume viewer, kiosk mode)

---

🧱 Project Structure

cookiex/
├── main.py                # Entry point
├── extract/               # Browser-specific modules
├── crypto/                # AES/Fernet encryption
├── storage/               # Vault handling
├── utils/                 # DPAPI, Keychain, logging
└── config.py              # Runtime options

---

👤 Author

Developed by Troy Locke
GitHub: @cookiexfiltrate
Project: cookiex
License: MIT (see LICENSE file)

---

📜 Legal

This tool is published in accordance with the Computer Fraud and Abuse Act (CFAA) and other relevant laws.
Use of this tool without explicit authorization may violate federal, state, or international law.
You are responsible for complying with the laws in your jurisdiction.