Main Page

Firefox forensics

Objectives

This lab is a short follow-on lab to the browser forensics lab. It allows you to explore Firefox cookies and browser history.

Firefox stores its data in a database format known as sqlite3. Unfortunately caine 2.5.1 does not support the right sqlite format by default. However I have patched the virtual machine image to use the latest version.

We also need a few perl scripts to help us in the analysis. These will be installed when you press the initialise button. Firstly /home/caine/place.pl will analyse the history:

#!/usr/bin/perl -w
#
# Firefox Advanced history info.
# Adapted from http://snippets.dzone.com/posts/show/8431
# (which is usually in:
# "C:\Documents and Settings\${USER}\Application Data\Mozilla\Firefox\Profiles
#    \${PROFILE}\places.sqlite" )
#
use strict;
my $places=$ARGV[0];
die "$0: ERROR - can't find places.sqlite\n" if ! -f $places;

my $hist;
my $run_query = "echo 'select last_visit_date, url from moz_places;' | sqlite3 $places";
open (QUERY, "$run_query|") || die "Can't run '$run_query': $!\n";
while (defined (my $line = <QUERY>)) {
    if ( $line =~ /^([0-9]+)\|(.*)$/ ) {
        my ($time, $url) = ($1, $2);
        chomp $url;

        if ( length($time) > 10 ) {
            $time = substr($time, 0, 10);
        }
        $hist->{$url} = {
           time => $time,
           url => $url,
        };
    }
}
close QUERY;

my @mon  = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
my @day  = qw( Sun Mon Tue Wed Thu Fri Sat );

sub by_time ($$) {
    my ($a, $b) = (shift, shift);
    $hist->{$a}->{time} <=> $hist->{$b}->{time};
}

for my $key ( sort by_time keys %{$hist} ) {
    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)
    = gmtime($hist->{$key}->{time});

    printf "%4d-%02d-%02d %02d:%02d:%02d (%s %02d %s %04d) %s\n",
        $year + 1900, $mon + 1, $mday, $hour, $min, $sec,
        $day[$wday], $mday, $mon[$mon], $year + 1900,
        $hist->{$key}->{url};
}

In order to view firefox cookie information you may find the following useful too. We call this file /home/caine/cookies.pl.

#!/usr/bin/perl -w
#
use strict;
my $cookies = $ARGV[0];
die "$0: ERROR - can't find cookie file $cookies\n" if ! -f "$cookies";

my @db;
#moz_cookies (id INTEGER PRIMARY KEY, baseDomain TEXT, name TEXT, value TEXT,
#             host TEXT, path TEXT, expiry INTEGER, lastAccessed INTEGER,
#             creationTime INTEGER, isSecure INTEGER, isHttpOnly INTEGER

my $run_query = "echo 'select lastAccessed, baseDomain, name, value from moz_cookies;' | sqlite3 $cookies";
open (QUERY, "$run_query|") || die "Can't run '$run_query': $!\n";
while (defined (my $line = <QUERY>)) {

    if ( $line =~ /^([0-9]+)\|(.*)\|(.*)\|(.*)$/ ) {
        my ($time,$base,$name,$value) = ($1, $2,$3,$4);
        if ( length($time) > 10 ) {
            $time = substr($time, 0, 10);
        }
        push @db,{ time => $time, base => $base,
                   name => $name, value => $value
        };
    }
}
close QUERY;

my @mon  = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
my @day  = qw( Sun Mon Tue Wed Thu Fri Sat );

for my $i ( sort {$a->{time} <=> $b->{time}} @db ) {
    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=gmtime($i->{time});
    printf "%4d-%02d-%02d %02d:%02d:%02d (%s %02d %s %04d) %s %s %s\n",
        $year + 1900, $mon + 1, $mday, $hour, $min, $sec,
        $day[$wday], $mday, $mon[$mon], $year + 1900,
        $i->{base},$i->{name},$i->{value};

}

Both of these scripts will be created automatically in the /home/caine directory when you press the initialise button below.

Documents and Settings/<USER>/Application Data/Mozilla/Firefox/Profiles/

$ ./place.pl places.sqlite

Copyright @ 2004-2012 Gordon Russell. All rights reserved.