mirror of
https://github.com/moonD4rk/HackBrowserData.git
synced 2026-05-19 18:58:03 +02:00
Roger
1ec2781131
* feat: add Firefox extract methods and complete data model fields Firefox extract methods: - extractPasswords: JSON + ASN1PBE decryption via decryptPBE helper - extractCookies: SQLite, plaintext (no encryption), journalOff - extractHistories: SQLite, visit count ASC sort (matches old behavior) - extractDownloads: SQLite, moz_annos JOIN with JSON content parsing - extractBookmarks: SQLite, moz_bookmarks JOIN moz_places - extractExtensions: JSON, filter by location=app-profile - extractLocalStorage: SQLite webappsstore2, reversed originKey parsing Complete data model fields (union of Chromium and Firefox): - CookieEntry: add HasExpire, IsPersistent - DownloadEntry: add MimeType - CreditCardEntry: add NickName, Address - ExtensionEntry: add HomepageURL, Enabled Update Chromium extractors to populate new fields: - extract_cookie.go: fill HasExpire, IsPersistent - extract_download.go: SELECT and fill mime_type - extract_creditcard.go: SELECT nickname, billing_address_id - extract_extension.go: fill HomepageURL, Enabled (state==1) Tests: - Full test coverage for all 7 Firefox extract functions - Password test uses known ASN1PBE test vectors from crypto package - Table-driven tests for parseOriginKey - Updated Chromium tests for new fields * fix: add COALESCE for nullable bookmark title in Firefox query Firefox moz_bookmarks.title can be NULL (PR #500 fixed this in old code). Add COALESCE to handle NULL gracefully in SQL instead of relying on driver-specific NULL→string conversion behavior. * fix: enable journalOff for all Firefox SQLite extractors and populate cookie flags - Set journalOff=true for extract_history, extract_download, extract_bookmark (Firefox databases require PRAGMA journal_mode=off to avoid lock errors) - Populate HasExpire and IsPersistent for Firefox cookies (derived from expiry>0) - Add test assertions for HasExpire/IsPersistent in both Chromium and Firefox
107 lines
2.8 KiB
Go
107 lines
2.8 KiB
Go
package firefox
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// These values are from crypto/asn1pbe_test.go loginPBETestCases.
|
|
// loginPBE hex decrypts to "Hello, World!" with globalSalt = "moond4rk" * 3.
|
|
const loginPBEHex = "303b0410f8000000000000000000000000000001301506092a864886f70d010503040830313233343536370410fe968b6565149114ea688defd6683e45"
|
|
|
|
var testGlobalSalt = bytes.Repeat([]byte("moond4rk"), 3) // 24 bytes
|
|
|
|
func loginPBEBase64(t *testing.T) string {
|
|
t.Helper()
|
|
raw, err := hex.DecodeString(loginPBEHex)
|
|
require.NoError(t, err)
|
|
return base64.StdEncoding.EncodeToString(raw)
|
|
}
|
|
|
|
func TestExtractPasswords(t *testing.T) {
|
|
encB64 := loginPBEBase64(t)
|
|
|
|
// Construct a logins.json with known encrypted username/password
|
|
json := fmt.Sprintf(`{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://example.com",
|
|
"formSubmitURL": "https://example.com/login",
|
|
"encryptedUsername": "%s",
|
|
"encryptedPassword": "%s",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`, encB64, encB64)
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
require.Len(t, got, 1)
|
|
|
|
// Both username and password decrypt to "Hello, World!"
|
|
assert.Equal(t, "Hello, World!", got[0].Username)
|
|
assert.Equal(t, "Hello, World!", got[0].Password)
|
|
assert.Equal(t, "https://example.com/login", got[0].URL)
|
|
assert.False(t, got[0].CreatedAt.IsZero())
|
|
}
|
|
|
|
func TestExtractPasswords_FormSubmitURLFallback(t *testing.T) {
|
|
encB64 := loginPBEBase64(t)
|
|
|
|
// When formSubmitURL is empty, should fall back to hostname
|
|
json := fmt.Sprintf(`{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://fallback.com",
|
|
"formSubmitURL": "",
|
|
"encryptedUsername": "%s",
|
|
"encryptedPassword": "%s",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`, encB64, encB64)
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
require.Len(t, got, 1)
|
|
assert.Equal(t, "https://fallback.com", got[0].URL)
|
|
}
|
|
|
|
func TestExtractPasswords_InvalidBase64Skipped(t *testing.T) {
|
|
// Invalid base64 in encryptedUsername — entry should be skipped
|
|
json := `{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://bad.com",
|
|
"encryptedUsername": "not-valid-base64!!!",
|
|
"encryptedPassword": "also-bad",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, got) // skipped, not error
|
|
}
|
|
|
|
func TestExtractPasswords_EmptyLogins(t *testing.T) {
|
|
path := createTestJSON(t, "logins.json", `{"logins": []}`)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, got)
|
|
}
|