Module 0x6 | Forensic Kung Fu

Firefox Investigation

You can find Firefox profile databases in
  • Linux
  • Windows
In above directories, there are many SQLite database files, so let's to import these databases and see what we get
require 'sqlite3'
# Browser history
db = "places.sqlite"
# List all tables
db.execute "SELECT * FROM sqlite_master where type='table'"
# List all visited URLs (History)
db.execute "SELECT url FROM moz_places"
# List all bookmarks
db.execute "SELECT title FROM moz_bookmarks"
# List all Cookies
db = "cookies.sqlite"
db.execute "SELECT baseDomain, name, host, path, value FROM moz_cookies"
# List all form history
db = "formhistory.sqlite"
db.execute "SELECT fieldname, value FROM moz_formhistory"
More about Firefox forensic

Google Chrome Investigation

  • Linux
  • Windows
    C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\
require 'sqlite3'
# List all Cookies
db = "Cookies"
db.execute "SELECT host_key, path, name, value FROM cookies"
More about Chrome forensic