Internet Parser Update

In honor of Randy G (see this post) and the fact that I found a new browser, I have updated the Internet parser program to now include the Flock browser, which is based on the Mozilla framework. Now I have not done an extensive analysis on yet but I have done enough to know it fits right in with Firefox 3.x and Google Chrome as it uses SQLite to store its history and other files. One thing to note is that there is a new report added called Form History. This is a new database that flock uses that keeps data that was entered into any forms. That is about all I know about the forms at this point. There are quite a few new databases that Flock uses and I will have to test them out to see what data points can be pulled out.

So in honor of Randy G. here is the download.

Questions/Comments/Suggestions?

Updates Before the New Year

Here are a few updates to some of the programs I have provided this year.

Skype Log Parser:

This program will now parse the voicemail logs and report on them. It will also extract some more information about the users. The avatars will also be parsed out and saved to the report directory as well. The program can be found here. I also want to thank the University of New Orleans (Team NSSAL) for using this program in the DC3 Challenge this year, I created the program for my use in the challenge but when I got bogged down with other things I thought I would release it in hopes that someone would use it for the challenge.

Thumbnail_Html:

I do not recall if I ever released this or not but what what it will do is parse a directory and create a web page with thumbnails of graphics files in it. This program is good if you need to create a file that has graphics that you want to send to someone and be able to put it on a CD/DVD. This program will also read some of the EXIF info for the graphics and output that information as well. The program can be found here.

Internet Parser:

This is the updated google chrome parser with a few more reports and I have also added the option to include Firefox history files as well. With this program if someone had both Firefox and Google Chrome you can add both of there history files to the same database and do 1 reports instead of multiple reports. This program can be found here.

Internet History:

This program reads in the Internet Explorer index.dat, the cookie index.dat and the History index.dat files and will produce reports on them. The reports should be similar to the internet parser program. That program can be found here.

I hope you enjoy all these updated and new programs and that you get quite a bit of use out of them.

As always Questions/Comments/Suggestions/Thoughts?

Google Chrome stores plain text passwords….sort of.

My interest was of course piqued when Google announced they would be entering the browser realm, with Chrome. One of the things that has always interested me is the way different programs store passwords. While we are still working on decrypting the Chrome passwords from an imaged drive, I did make an interesting discovery about Chrome storing plain text passwords. Chrome is reliant on several files under the following paths

(dependent on OS):

XP:

Documents and Settings/User/Local Settings/Application Data/Google/Chrome/


Vista:

Users/App Data/Local/Google/Chrome/


As it turns out, if you visit a site that does not require you to log in via https or any variety of other secure methods, Chrome will create a cookie, which can be found in the file “Current Session” under Chrome/User Data/Default. Within that file will be a plain text cookie with your login name and password. If the site requires https, you can still view the log in, but the password is encrypted. However, there is one neat twist to this. If you log in with an incorrect password, even from an https site, the password is still saved in plain text. Using this information, you may be able to make an educated guess on what the actual password was. You can open the file with any text viewing program, or a Hex editor program.


This password recovery method unfortunately only works if, during the last instance of the browser being opened, the person typed in their password when prompted at a site that does not use a secure method to log-in. I also created a slide show presentation, which is can be found here, detailing the steps and data that can be viewed within Chrome.

As always Thoughts/Comments/Questions?

Google Chrome Log Parser

Google Chrome has been out for about a week and here is my first attempt to create a program that will parse out all the chrome logs and put together some useful reports. The program can be found here.

Just like Firefox, Chrome also stores their logs into a SQLite database. Some of these logs are very similar to the Firefox logs. One thing to note is that Chrome is not very consistent with which format they use for date/time. In some logs they use Unix Epoch time (Jan 1 1970) and in others they use Microsoft Epoch time (Jan 1 1601). Chrome also stores a thumbnail of web pages in these logs as well. These thumbnails are used when you fist start chrome to show you 9 pages you have visited. With the above log parser it will pull these thumbnails out and present them in the reports as well.

As I stated above this program is a work in progress and there is still more research to be done to make it a better. I just wanted to get it out to all you guys to start to play with it.

As always Questions/Comments/Suggestions.