Browser dump (chrome,firefox) implemented

documentation-payload/Cazalla/features.md

@@ -466,6 +466,41 @@ Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
 
 For detailed information, see [browser_info command documentation](commands/browser_info.md).
 
+#### `browser_dump`
+
+Extracts cookies, saved passwords, and bookmarks from web browsers.
+
+**Supported Browsers:**
+- Google Chrome
+- Mozilla Firefox
+
+**Extracted Data:**
+- Cookies with decrypted values (display only, NOT stored as credentials)
+- Saved passwords (logins) with usernames
+- Bookmarks with URLs
+
+**Credential Reporting:**
+- **Passwords**: Automatically saved to Mythic's credential store as `plaintext` credential type
+- **Cookies**: Displayed in output but NOT stored as credentials (for manual use only)
+- Realms automatically extracted from URLs
+
+**Cookie Filtering:**
+- Only shows session cookies useful for authentication/impersonation
+- Filters out tracking cookies and cookies with security flags
+
+**OPSEC Considerations:**
+- HIGH DETECTION RISK - Browser credential access is heavily monitored
+- EDR/XDR solutions have specific detection rules
+- File access to browser databases triggers alerts
+- Always requires approval from another operator
+
+**Example:**
+```
+browser_dump chrome
+```
+
+For detailed information, see [browser_dump command documentation](commands/browser_dump.md).
+
 ---
 
 ## OPSEC Checking
@@ -486,7 +521,7 @@ Cazalla includes comprehensive OPSEC Checking functionality that provides operat
 
 ### Commands with OPSEC Checking
 
-- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files)
+- **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files), `browser_dump`
 - **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, `browser_info`, etc.
 
 ### Bypass Roles