mirror of
https://github.com/moonD4rk/HackBrowserData.git
synced 2026-05-19 18:58:03 +02:00
Roger
1ec2781131
* feat: add Firefox extract methods and complete data model fields Firefox extract methods: - extractPasswords: JSON + ASN1PBE decryption via decryptPBE helper - extractCookies: SQLite, plaintext (no encryption), journalOff - extractHistories: SQLite, visit count ASC sort (matches old behavior) - extractDownloads: SQLite, moz_annos JOIN with JSON content parsing - extractBookmarks: SQLite, moz_bookmarks JOIN moz_places - extractExtensions: JSON, filter by location=app-profile - extractLocalStorage: SQLite webappsstore2, reversed originKey parsing Complete data model fields (union of Chromium and Firefox): - CookieEntry: add HasExpire, IsPersistent - DownloadEntry: add MimeType - CreditCardEntry: add NickName, Address - ExtensionEntry: add HomepageURL, Enabled Update Chromium extractors to populate new fields: - extract_cookie.go: fill HasExpire, IsPersistent - extract_download.go: SELECT and fill mime_type - extract_creditcard.go: SELECT nickname, billing_address_id - extract_extension.go: fill HomepageURL, Enabled (state==1) Tests: - Full test coverage for all 7 Firefox extract functions - Password test uses known ASN1PBE test vectors from crypto package - Table-driven tests for parseOriginKey - Updated Chromium tests for new fields * fix: add COALESCE for nullable bookmark title in Firefox query Firefox moz_bookmarks.title can be NULL (PR #500 fixed this in old code). Add COALESCE to handle NULL gracefully in SQL instead of relying on driver-specific NULL→string conversion behavior. * fix: enable journalOff for all Firefox SQLite extractors and populate cookie flags - Set journalOff=true for extract_history, extract_download, extract_bookmark (Firefox databases require PRAGMA journal_mode=off to avoid lock errors) - Populate HasExpire and IsPersistent for Firefox cookies (derived from expiry>0) - Add test assertions for HasExpire/IsPersistent in both Chromium and Firefox
71 lines
1.7 KiB
Go
71 lines
1.7 KiB
Go
package firefox
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"os"
|
|
"sort"
|
|
|
|
"github.com/tidwall/gjson"
|
|
|
|
"github.com/moond4rk/hackbrowserdata/crypto"
|
|
"github.com/moond4rk/hackbrowserdata/log"
|
|
"github.com/moond4rk/hackbrowserdata/types"
|
|
"github.com/moond4rk/hackbrowserdata/utils/typeutil"
|
|
)
|
|
|
|
// decryptPBE combines base64 decode + ASN1 PBE parse + decrypt into one call.
|
|
func decryptPBE(encoded string, masterKey []byte) ([]byte, error) {
|
|
raw, err := base64.StdEncoding.DecodeString(encoded)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("base64 decode: %w", err)
|
|
}
|
|
pbe, err := crypto.NewASN1PBE(raw)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parse asn1 pbe: %w", err)
|
|
}
|
|
plaintext, err := pbe.Decrypt(masterKey)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("decrypt: %w", err)
|
|
}
|
|
return plaintext, nil
|
|
}
|
|
|
|
func extractPasswords(masterKey []byte, path string) ([]types.LoginEntry, error) {
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var logins []types.LoginEntry
|
|
for _, v := range gjson.GetBytes(data, "logins").Array() {
|
|
user, err := decryptPBE(v.Get("encryptedUsername").String(), masterKey)
|
|
if err != nil {
|
|
log.Debugf("decrypt username: %v", err)
|
|
continue
|
|
}
|
|
pwd, err := decryptPBE(v.Get("encryptedPassword").String(), masterKey)
|
|
if err != nil {
|
|
log.Debugf("decrypt password: %v", err)
|
|
continue
|
|
}
|
|
|
|
url := v.Get("formSubmitURL").String()
|
|
if url == "" {
|
|
url = v.Get("hostname").String()
|
|
}
|
|
|
|
logins = append(logins, types.LoginEntry{
|
|
URL: url,
|
|
Username: string(user),
|
|
Password: string(pwd),
|
|
CreatedAt: typeutil.TimeStamp(v.Get("timeCreated").Int() / 1000),
|
|
})
|
|
}
|
|
|
|
sort.Slice(logins, func(i, j int) bool {
|
|
return logins[i].CreatedAt.After(logins[j].CreatedAt)
|
|
})
|
|
return logins, nil
|
|
}
|