mirror of
https://github.com/moonD4rk/HackBrowserData.git
synced 2026-05-19 18:58:03 +02:00
Roger
1a3aea553e
* feat: add Firefox Browser implementation with new v2 architecture Add Firefox NewBrowsers + Extract pipeline following the Chromium v2 pattern. Firefox-specific differences handled: - Profile discovery: random directory names (e.g. abc123.default-release) - Master key: NSS/ASN1PBE from key4.db (platform-agnostic, no DPAPI/Keychain) - Key validation: reuse logins.json from acquireFiles tempPaths - Extract: only Password needs masterKey; Cookie is plaintext - No CreditCard or SessionStorage support Files: - firefox_new.go: Browser struct, NewBrowsers, Extract, getMasterKey, extractCategory, deriveKeys, validateKeyWithLogins, profile discovery - masterkey.go: extracted shared NSS logic (processMasterKey, queryMetaData, queryNssPrivateCandidates, parseLoginCipherPairs, canDecryptAnyLoginCipherPair) - firefox_new_test.go: table-driven tests with shared fixtures - source.go: remove dataSource wrapper, use []sourcePath directly - firefox.go: remove functions moved to masterkey.go * fix: address Copilot review feedback on Firefox v2 - Fix stale comment referencing removed readLoginCipherPairs - Rename finallyKey to derivedKey for clarity in processMasterKey - Add sqlite driver import to masterkey.go for self-containedness * refactor: rewrite Firefox masterkey and improve naming Masterkey rewrite: - Replace raw SQL functions with structured key4DB type (globalSalt, passwordCheck, privateKeys) for clear data modeling - Split processMasterKey into verifyPasswordCheck + decryptPrivateKey - Add nssKeyTypeTag constant for the magic bytes - Rename finallyKey to derivedKey - Add sqlite driver import for self-containedness - Return error (not fallback) when logins validation explicitly fails Naming cleanup: - loginPair → encryptedLogin (clarify these are encrypted blobs) - parseLoginPairs → sampleEncryptedLogins (clarify sampling purpose) - canDecryptLogin → tryDecryptLogins (accurate verb, plural alignment) - Expand abbreviated variables: p→login, uPBE→userPBE, pPBE→pwdPBE Password extraction: - Keep entries when decryptPBE fails (URL preserved, user/pwd empty) - Align with Chromium behavior where decrypt failure doesn't skip records Old code cleanup: - firefox.go GetMasterKey now delegates to retrieveMasterKey - Remove functions moved to masterkey.go * docs: add RFC-003 for crypto package naming cleanup Track accumulated naming and structural issues in crypto/asn1pbe.go and cross-browser shared code for a future dedicated refactoring pass. * refactor: move masterkey tests to masterkey_test.go - Rename firefox_test.go to masterkey_test.go since all tests in this file test masterkey.go functions (readKey4DB, sampleEncryptedLogins) - Fix TestReadKey4DB to check nssPrivate rows as a set instead of assuming SQLite insertion order - Future deletion of firefox.go won't accidentally remove masterkey tests
110 lines
2.9 KiB
Go
110 lines
2.9 KiB
Go
package firefox
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// These values are from crypto/asn1pbe_test.go loginPBETestCases.
|
|
// loginPBE hex decrypts to "Hello, World!" with globalSalt = "moond4rk" * 3.
|
|
const loginPBEHex = "303b0410f8000000000000000000000000000001301506092a864886f70d010503040830313233343536370410fe968b6565149114ea688defd6683e45"
|
|
|
|
var testGlobalSalt = bytes.Repeat([]byte("moond4rk"), 3) // 24 bytes
|
|
|
|
func loginPBEBase64(t *testing.T) string {
|
|
t.Helper()
|
|
raw, err := hex.DecodeString(loginPBEHex)
|
|
require.NoError(t, err)
|
|
return base64.StdEncoding.EncodeToString(raw)
|
|
}
|
|
|
|
func TestExtractPasswords(t *testing.T) {
|
|
encB64 := loginPBEBase64(t)
|
|
|
|
// Construct a logins.json with known encrypted username/password
|
|
json := fmt.Sprintf(`{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://example.com",
|
|
"formSubmitURL": "https://example.com/login",
|
|
"encryptedUsername": "%s",
|
|
"encryptedPassword": "%s",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`, encB64, encB64)
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
require.Len(t, got, 1)
|
|
|
|
// Both username and password decrypt to "Hello, World!"
|
|
assert.Equal(t, "Hello, World!", got[0].Username)
|
|
assert.Equal(t, "Hello, World!", got[0].Password)
|
|
assert.Equal(t, "https://example.com/login", got[0].URL)
|
|
assert.False(t, got[0].CreatedAt.IsZero())
|
|
}
|
|
|
|
func TestExtractPasswords_FormSubmitURLFallback(t *testing.T) {
|
|
encB64 := loginPBEBase64(t)
|
|
|
|
// When formSubmitURL is empty, should fall back to hostname
|
|
json := fmt.Sprintf(`{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://fallback.com",
|
|
"formSubmitURL": "",
|
|
"encryptedUsername": "%s",
|
|
"encryptedPassword": "%s",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`, encB64, encB64)
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
require.Len(t, got, 1)
|
|
assert.Equal(t, "https://fallback.com", got[0].URL)
|
|
}
|
|
|
|
func TestExtractPasswords_DecryptFailureKeepsEntry(t *testing.T) {
|
|
// Invalid base64 — decryptPBE fails, but entry is still kept with empty user/pwd
|
|
json := `{
|
|
"logins": [
|
|
{
|
|
"hostname": "https://bad.com",
|
|
"encryptedUsername": "not-valid-base64!!!",
|
|
"encryptedPassword": "also-bad",
|
|
"timeCreated": 1700000000000
|
|
}
|
|
]
|
|
}`
|
|
|
|
path := createTestJSON(t, "logins.json", json)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
require.Len(t, got, 1)
|
|
assert.Equal(t, "https://bad.com", got[0].URL)
|
|
assert.Empty(t, got[0].Username) // decrypt failed → empty
|
|
assert.Empty(t, got[0].Password) // decrypt failed → empty
|
|
}
|
|
|
|
func TestExtractPasswords_EmptyLogins(t *testing.T) {
|
|
path := createTestJSON(t, "logins.json", `{"logins": []}`)
|
|
|
|
got, err := extractPasswords(testGlobalSalt, path)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, got)
|
|
}
|