KeeFarce
KeeFarce is a memory extraction tool designed to retrieve cleartext password database information from running KeePass 2.x processes. The tool operates by injecting a DLL into the target KeePass process to execute code within its context. It uses a bootstrap DLL to spawn a .NET runtime instance within the appropriate application domain, then executes the main C# payload (KeeFarceDLL.dll). The extraction process utilizes CLRMD (Common Language Runtime Memory Diagnostics) to locate necessary objects within the KeePass process heap. It identifies pointers to required sub-objects using memory offsets and employs reflection to call export methods for data retrieval. Extracted information includes usernames, passwords, notes, and URLs, which are exported to a CSV file stored in the %AppData% directory. The tool requires architecture-specific builds to match the target KeePass process (32-bit or 64-bit). For execution, four files must be present in the same directory: BootstrapDLL.dll, KeeFarce.exe, KeeFarceDLL.dll, and Microsoft.Diagnostic.Runtime.dll. The tool is designed for post-exploitation scenarios where an attacker has already gained access to a system running KeePass.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A command that builds and executes command lines from standard input, allowing for the execution of commands with multiple arguments.
Tool for enumerating proxy configurations and generating CobaltStrike-compatible shellcode.
SharpPrinter enables efficient discovery of network printers for security and management purposes.
A digital archive of the internet, allowing users to capture and browse archived web pages.
PyBOF is a Python library that enables in-memory loading and execution of Beacon Object Files (BOFs) with support for argument passing and function targeting.
Interactive online malware sandbox for real-time analysis and threat intelligence
A suite of tools for Wi-Fi network security assessment and penetration testing.
A CVE compliant archive of public exploits and corresponding vulnerable software, and a categorized index of Internet search engine queries designed to uncover sensitive information.
BeEF is a specialized penetration testing tool for exploiting web browser vulnerabilities to assess security.
PINNED
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.