How to Extract Browser History in Linux Systems
Linux tools used in this demo.
- cat
- netcat
- ls
In this demo, we will be extracting firefox browser history.
Scenario: You are tasked to perform live forensics on a Linux-based system to gather its browser history.
Firefox browser history can be found at: ~/.Mozilla/firefox/<dir>/places.sqlite
In this step, we run “cat” command and pipe to “>” operator to save it to disk.
Command: cat ~/.mozilla/firefox/*/places.sqlite > browser_history.txt
In this case, we use “*” so it will search to all available directory for “places.sqlite” rather than manually searching each directory.
Since we will be using a Windows box to analyze our file, we will be using “netcat” for both Linux and Windows system to perform the transfer.
To do this, we can run netcat command from out Linux Box.
Command: netcat -w 2 <listener_windowsIP> <port> < browser_hist.txt
This put out Linux box to an idle mode waiting for the netcat listener.
Next, we setup our netcat listener from our Windows machine.
Command: ncat -l 4444 > browser_history.txt
After successful execution, we can now confirm our file when we open it to our text editor tool “notepad”.
In this step, we will be using bstrings.exe from EZ tools to do the work for us.
To do this, open cmd prompt and Run As Admin and run the following commands:
- bstrings.exe -f browser_history.txt -p
- bstrings.exe -f browser_history –lr url3986 > browser_history_after.txt
- bstrings.exe -f browser_history.txt -p
Learn and Download bstrings here: https://www.eyehatemalwares.com/incident-response/eztools/bstrings/
Why bstrings? Examining raw data from our dumped file “places.sqlite” takes a lot of work if we do it manually.
In this step, we can finally compare both raw browser_history.txt and browser_history_after.txt
In this case, we can see that the strings that doesn’t match the regex URL pattern from bstrings.exe are removed and only presented us only the URL format.
Browser history can reveal artifacts that can help the analyst during investigation, it can reveal information such as C2C server and also, this approach doesn’t limit to Firefox browser only, as an Analyst we can leverage this approach to investigate other browser’s history.
