Default/History（实际为 History-journal）

CREATE TABLE urls (
    id INTEGER PRIMARY KEY,
    url TEXT NOT NULL,
    title TEXT NOT NULL,
    visit_count INTEGER NOT NULL DEFAULT 0,
    typed_count INTEGER NOT NULL DEFAULT 0,
    last_visit_time INTEGER NOT NULL DEFAULT 0,
    hidden INTEGER NOT NULL DEFAULT 0
);

CREATE TABLE visits (
    id INTEGER PRIMARY KEY,
    url INTEGER NOT NULL,
    visit_time INTEGER NOT NULL,
    from_visit INTEGER,
    transition INTEGER NOT NULL DEFAULT 0,
    segment_id INTEGER,
    is_indexed INTEGER
);

SELECT
    u.url,
    u.title,
    u.visit_count,
    u.typed_count,
    u.last_visit_time,
    v.visit_time,
    v.transition
FROM urls u
JOIN visits v ON u.id = v.url
ORDER BY v.visit_time DESC
LIMIT 100;

SELECT
    datetime((last_visit_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS readable_time,
    url,
    title,
    visit_count
FROM urls
ORDER BY last_visit_time DESC;

SELECT
    p.url,
    p.title,
    p.visit_count,
    p.last_visit_date,
    hv.visit_type,
    datetime(hv.visit_date / 1000000, 'unixepoch', 'localtime') AS visit_time
FROM moz_places p
JOIN moz_historyvisits hv ON p.id = hv.place_id
ORDER BY hv.visit_date DESC
LIMIT 100;

SELECT
    u.url,
    u.title,
    u.visit_count,
    u.typed_count,
    datetime((u.last_visit_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS last_visit
FROM urls u
WHERE u.visit_count > 10
ORDER BY u.visit_count DESC
LIMIT 50;

SELECT
    CASE
        WHEN url LIKE '%://%' THEN
            SUBSTR(url,
                INSTR(url, '://') + 3,
                INSTR(SUBSTR(url, INSTR(url, '://') + 3), '/') - 1
            )
        ELSE url
    END AS domain,
    SUM(visit_count) AS total_visits,
    COUNT(*) AS unique_urls,
    MAX(last_visit_time) AS last_access
FROM urls
GROUP BY domain
ORDER BY total_visits DESC
LIMIT 30;

SELECT
    datetime((v.visit_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS visit_time,
    u.url,
    u.title,
    CASE v.transition
        WHEN 0 THEN 'TYPED'
        WHEN 1 THEN 'LINK'
        WHEN 2 THEN 'BOOKMARK'
        WHEN 3 THEN 'SUBFRAME'
        WHEN 4 THEN 'REDIRECT'
        WHEN 5 THEN 'RELOAD'
        WHEN 6 THEN 'KEYWORD'
        WHEN 7 THEN 'GENERATE'
        ELSE 'UNKNOWN'
    END AS transition_type
FROM visits v
JOIN urls u ON v.url = u.id
WHERE v.visit_time BETWEEN ? AND ?
ORDER BY v.visit_time ASC;

SELECT
    ks.term,
    u.url,
    u.title,
    datetime((u.last_visit_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS search_time
FROM keyword_search_terms ks
JOIN urls u ON ks.url_id = u.id
ORDER BY u.last_visit_time DESC
LIMIT 100;

SELECT
    term,
    COUNT(*) AS search_count
FROM keyword_search_terms
GROUP BY term
ORDER BY search_count DESC
LIMIT 50;

SELECT * FROM urls WHERE hidden != 0;

SELECT * FROM urls WHERE visit_count = 0 AND typed_count > 0;

SELECT * FROM urls WHERE last_visit_time = 0 AND visit_count > 0;

PRAGMA journal_mode;
PRAGMA integrity_check;
PRAGMA page_count;
PRAGMA freelist_count;

SELECT
    host_key,
    name,
    value,
    path,
    expires_utc,
    is_secure,
    is_httponly,
    samesite,
    datetime((expires_utc / 1000000) - 11644473600, 'unixepoch', 'localtime') AS expiry_time,
    datetime((creation_utc / 1000000) - 11644473600, 'unixepoch', 'localtime') AS creation_time
FROM cookies
ORDER BY creation_utc DESC
LIMIT 100;

SELECT
    host,
    name,
    value,
    path,
    expiry,
    isSecure,
    isHttpOnly,
    datetime(expiry, 'unixepoch', 'localtime') AS expiry_time,
    datetime(lastAccessed / 1000000, 'unixepoch', 'localtime') AS last_access
FROM moz_cookies
ORDER BY lastAccessed DESC
LIMIT 100;

import sqlite3
import os
import json
import base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes

def get_encryption_key(browser_profile_path):
    local_state_path = os.path.join(
        os.path.dirname(browser_profile_path),
        os.path.basename(os.path.dirname(browser_profile_path)),
        os.path.join(browser_profile_path, '..', '..', 'Local State')
    )
    local_state_path = os.path.normpath(local_state_path)
    with open(local_state_path, 'r', encoding='utf-8') as f:
        local_state = json.load(f)
    encrypted_key = base64.b64decode(local_state['os_crypt']['encrypted_key'])
    encrypted_key = encrypted_key[5:]
    import subprocess
    result = subprocess.run(
        ['powershell', '-command',
         f'(ConvertTo-SecureString -String ([System.Text.Encoding]::Default.GetString([Convert]::FromBase64String("{base64.b64encode(encrypted_key).decode()}"))) -AsPlainText -Force | ConvertFrom-SecureString)'],
        capture_output=True, text=True
    )
    return result.stdout.strip()

def decrypt_cookie_value(encrypted_value, key):
    if encrypted_value[:3] == b'v10' or encrypted_value[:3] == b'v11':
        nonce = encrypted_value[3:15]
        ciphertext = encrypted_value[15:]
        aesgcm = AESGCM(key)
        return aesgcm.decrypt(nonce, ciphertext, None).decode('utf-8')
    return encrypted_value.decode('utf-8', errors='replace')

def extract_cookies(db_path):
    conn = sqlite3.connect(db_path)
    cursor = conn.cursor()
    cursor.execute("""
        SELECT host_key, name, encrypted_value, path,
               datetime((expires_utc / 1000000) - 11644473600, 'unixepoch', 'localtime'),
               is_secure, is_httponly
        FROM cookies
        WHERE host_key LIKE '%example.com%'
        ORDER BY expires_utc DESC
    """)
    cookies = []
    for row in cursor.fetchall():
        host, name, enc_value, path, expiry, secure, httponly = row
        cookies.append({
            'host': host,
            'name': name,
            'path': path,
            'expiry': expiry,
            'secure': bool(secure),
            'httponly': bool(httponly),
            'encrypted': bool(enc_value)
        })
    conn.close()
    return cookies

SELECT
    host_key,
    COUNT(*) AS cookie_count,
    MIN(creation_utc) AS first_seen,
    MAX(expires_utc) AS last_expiry
FROM cookies
WHERE host_key NOT LIKE '%google.com%'
  AND host_key NOT LIKE '%microsoft.com%'
  AND host_key NOT LIKE '%mozilla.org%'
GROUP BY host_key
ORDER BY cookie_count DESC
LIMIT 30;

SELECT
    host_key,
    name,
    LENGTH(encrypted_value) AS value_length,
    is_secure,
    is_httponly,
    datetime((creation_utc / 1000000) - 11644473600, 'unixepoch', 'localtime') AS created
FROM cookies
WHERE LENGTH(encrypted_value) > 1024
ORDER BY LENGTH(encrypted_value) DESC
LIMIT 20;

import os
import struct
import datetime

def parse_chrome_cache_index(index_path):
    results = []
    with open(index_path, 'rb') as f:
        header = f.read(12)
        if len(header) < 12:
            return results
        signature = struct.unpack_from('<I', header, 0)[0]
        if signature != 0xC10343C2:
            return results
        flags = struct.unpack_from('<H', header, 4)[0]
        entry_count = struct.unpack_from('<I', header, 6)[0]
        table_size = struct.unpack_from('<I', header, 8)[0]
        f.seek(table_size * 4, 1)
        for _ in range(entry_count):
            entry_header = f.read(25)
            if len(entry_header) < 25:
                break
            hash_value = struct.unpack_from('<I', entry_header, 0)[0]
            ref_count = struct.unpack_from('<H', entry_header, 4)[0]
            state = struct.unpack_from('<B', entry_header, 6)[0]
            key_length = struct.unpack_from('<H', entry_header, 13)[0]
            key_data = f.read(key_length)
            try:
                url = key_data.decode('utf-8', errors='replace')
            except Exception:
                url = str(key_data)
            results.append({
                'hash': hash_value,
                'state': state,
                'url': url
            })
    return results

SELECT
    d.id,
    d.guid,
    d.target_path,
    d.target_bytes,
    d.start_time,
    d.finished_time,
    d.received_bytes,
    d.state,
    d.danger_type,
    d.interrupt_reason,
    d.opened,
    datetime((d.start_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_start,
    datetime((d.finished_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_end,
    duc.chain
FROM downloads d
JOIN (
    SELECT download_id,
           GROUP_CONCAT(url, ' -> ') AS chain
    FROM downloads_url_chains
    GROUP BY download_id
) duc ON d.id = duc.download_id
ORDER BY d.start_time DESC;

SELECT
    d.id,
    d.source,
    d.target,
    d.contentType,
    d.totalBytes,
    d.currentBytes,
    datetime(d.startTime / 1000000, 'unixepoch', 'localtime') AS start_time,
    datetime(d.endTime / 1000000, 'unixepoch', 'localtime') AS end_time,
    d.state,
    d.referrer,
    p.url AS page_url
FROM moz_downloads d
LEFT JOIN moz_places p ON d.place_id = p.id
ORDER BY d.startTime DESC;

SELECT
    datetime((d.start_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_time,
    duc.chain AS url_chain,
    d.target_path,
    d.target_bytes,
    CASE d.state
        WHEN 0 THEN 'IN_PROGRESS'
        WHEN 1 THEN 'COMPLETE'
        WHEN 2 THEN 'CANCELLED'
        ELSE 'UNKNOWN'
    END AS download_state,
    CASE d.danger_type
        WHEN 0 THEN 'SAFE'
        WHEN 1 THEN 'DANGEROUS_URL'
        WHEN 2 THEN 'DANGEROUS_CONTENT'
        WHEN 3 THEN 'UNCOMMON'
        WHEN 4 THEN 'POTENTIALLY_UNWANTED'
        WHEN 5 THEN 'BLOCKED'
        WHEN 6 THEN 'POLICY'
        WHEN 7 THEN 'ACCEPTED'
        ELSE 'UNKNOWN'
    END AS danger_level
FROM downloads d
JOIN downloads_url_chains duc ON d.id = duc.download_id
WHERE d.danger_type > 0
ORDER BY d.start_time DESC;

SELECT
    datetime((d.start_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_start,
    datetime((d.finished_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_end,
    ROUND((d.finished_time - d.start_time) / 1000000.0, 2) AS duration_seconds,
    d.target_path,
    ROUND(d.target_bytes / 1024.0, 2) AS size_kb,
    CASE d.opened
        WHEN 0 THEN 'NOT_OPENED'
        WHEN 1 THEN 'OPENED'
        ELSE 'UNKNOWN'
    END AS was_opened
FROM downloads d
WHERE d.state = 1
ORDER BY d.start_time ASC;

SELECT
    d.id,
    d.target_path,
    d.target_bytes,
    datetime((d.start_time / 1000000) - 11644473600, 'unixepoch', 'localtime') AS download_time,
    u.url AS source_url
FROM downloads d
JOIN downloads_url_chains duc ON d.id = duc.download_id
JOIN urls u ON duc.url_id = u.id
WHERE d.danger_type > 0 OR d.interrupt_reason != 0
ORDER BY d.start_time DESC;

Default/Extensions/
    <extension_id>/
        <version>/
            manifest.json
            background.js
            content.js
            ...

SELECT json_extract(value, '$.name') AS extension_name,
       json_extract(value, '$.version') AS version,
       json_extract(value, '$.description') AS description
FROM preferences
WHERE path LIKE '%Extensions%';

ls -la ~/Library/Application\ Support/Google/Chrome/Default/Extensions/*/
stat -f "%Sm %N" ~/Library/Application\ Support/Google/Chrome/Default/Extensions/*/*

find ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ \
    -name "manifest.json" -exec grep -l "webRequest" {} \;

import json
import os
import glob

def analyze_extension_permissions(extensions_dir):
    results = []
    manifest_files = glob.glob(os.path.join(extensions_dir, '**', 'manifest.json'), recursive=True)
    for manifest_path in manifest_files:
        try:
            with open(manifest_path, 'r', encoding='utf-8') as f:
                manifest = json.load(f)
            permissions = manifest.get('permissions', [])
            host_permissions = manifest.get('host_permissions', manifest.get('permissions', []))
            name = manifest.get('name', 'Unknown')
            version = manifest.get('version', 'Unknown')
            suspicious_combos = []
            if '<all_urls>' in permissions and 'cookies' in permissions:
                suspicious_combos.append('ALL_URLS + COOKIES')
            if 'webRequest' in permissions and 'webRequestBlocking' in permissions:
                suspicious_combos.append('WEB_REQUEST_INTERCEPT')
            if 'nativeMessaging' in permissions:
                suspicious_combos.append('NATIVE_MESSAGING')
            if 'debugger' in permissions:
                suspicious_combos.append('DEBUGGER_ACCESS')
            results.append({
                'name': name,
                'version': version,
                'permissions': permissions,
                'suspicious': suspicious_combos,
                'manifest_path': manifest_path
            })
        except (json.JSONDecodeError, IOError):
            continue
    return results

ipconfig /displaydns

systemd-resolve --statistics

SELECT json_extract(value, '$.incognito_content_scripts') AS incognito_content,
       json_extract(value, '$.incognito') AS incognito_mode
FROM preferences;

Default/Preferences → sync → datatype_configs

SELECT json_extract(Preferences, '$.sync') AS sync_config
FROM preferences;

SELECT
    name,
    value,
    date_created,
    date_last_used,
    usage_count,
    datetime((date_created / 1000000) - 11644473600, 'unixepoch', 'localtime') AS created,
    datetime((date_last_used / 1000000) - 11644473600, 'unixepoch', 'localtime') AS last_used
FROM autofill
ORDER BY usage_count DESC
LIMIT 50;

SELECT
    '姓名' AS data_type,
    first_name || ' ' || middle_name || ' ' || last_name AS value
FROM autofill_profile_names
UNION ALL
SELECT
    '地址' AS data_type,
    street_address || ', ' || city || ', ' || state || ' ' || zip_code AS value
FROM autofill_profile_addresses
UNION ALL
SELECT
    '电话' AS data_type,
    number AS value
FROM autofill_profile_phones;

SELECT
    fieldname,
    value,
    timesUsed,
    datetime(firstUsed / 1000000, 'unixepoch', 'localtime') AS first_used,
    datetime(lastUsed / 1000000, 'unixepoch', 'localtime') AS last_used
FROM moz_formhistory
ORDER BY timesUsed DESC
LIMIT 50;

SELECT
    origin_url,
    username_value,
    CASE
        WHEN password_value IS NOT NULL THEN 'ENCRYPTED'
        ELSE 'EMPTY'
    END AS password_status,
    date_created,
    date_last_used,
    datetime((date_created / 1000000) - 11644473600, 'unixepoch', 'localtime') AS created,
    datetime((date_last_used / 1000000) - 11644473600, 'unixepoch', 'localtime') AS last_used,
    times_used,
    blacklisted_by_user
FROM logins
WHERE blacklisted_by_user = 0
ORDER BY times_used DESC
LIMIT 50;

import json

def parse_firefox_logins(logins_path):
    with open(logins_path, 'r', encoding='utf-8') as f:
        data = json.load(f)
    logins = data.get('logins', [])
    results = []
    for login in logins:
        results.append({
            'hostname': login.get('hostname', ''),
            'httpRealm': login.get('httpRealm', ''),
            'formSubmitURL': login.get('formSubmitURL', ''),
            'usernameEncrypted': bool(login.get('encryptedUsername', '')),
            'passwordEncrypted': bool(login.get('encryptedPassword', '')),
            'timeCreated': login.get('timeCreated', 0),
            'timeLastUsed': login.get('timeLastUsed', 0),
            'timesUsed': login.get('timesUsed', 0)
        })
    return results

钓鱼邮件 → 浏览器访问钓鱼站 → 下载 ZIP → 解压 ISO → 执行恶意代码 → 勒索加密

GitLab 代码下载 → 下载到 USB 路径 → 上传到 GitHub → 源代码泄露

钓鱼页面 → 窃取员工凭据 → 伪造会话 Cookie → 从外部 IP 冒充访问 → 窃取客户数据

import sqlite3
import os
import json
import csv
from datetime import datetime

CHROME_EPOCH = 11644473600

def chrome_timestamp_to_readable(ts):
    if ts == 0:
        return 'N/A'
    try:
        epoch = (ts / 1000000) - CHROME_EPOCH
        return datetime.utcfromtimestamp(epoch).strftime('%Y-%m-%d %H:%M:%S')
    except (ValueError, OSError):
        return 'INVALID'

def extract_chrome_history(profile_path):
    history_db = os.path.join(profile_path, 'History')
    if not os.path.exists(history_db):
        return []
    conn = sqlite3.connect(history_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT u.url, u.title, u.visit_count, u.typed_count,
               u.last_visit_time, v.visit_time, v.transition
        FROM urls u
        LEFT JOIN visits v ON u.id = v.url
        ORDER BY v.visit_time DESC
    ''')
    results = []
    for row in cursor.fetchall():
        url, title, visit_count, typed_count, last_visit, visit_time, transition = row
        results.append({
            'url': url,
            'title': title,
            'visit_count': visit_count,
            'typed_count': typed_count,
            'last_visit': chrome_timestamp_to_readable(last_visit or 0),
            'visit_time': chrome_timestamp_to_readable(visit_time or 0),
            'transition': transition
        })
    conn.close()
    return results

def extract_chrome_cookies(profile_path):
    cookies_db = os.path.join(profile_path, 'Cookies')
    if not os.path.exists(cookies_db):
        return []
    conn = sqlite3.connect(cookies_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT host_key, name, path,
               datetime((expires_utc / 1000000) - 11644473600, 'unixepoch', 'localtime'),
               is_secure, is_httponly,
               datetime((creation_utc / 1000000) - 11644473600, 'unixepoch', 'localtime')
        FROM cookies
        ORDER BY creation_utc DESC
    ''')
    results = []
    for row in cursor.fetchall():
        host, name, path, expiry, secure, httponly, created = row
        results.append({
            'host': host,
            'name': name,
            'path': path,
            'expiry': expiry,
            'secure': bool(secure),
            'httponly': bool(httponly),
            'created': created
        })
    conn.close()
    return results

def extract_chrome_downloads(profile_path):
    history_db = os.path.join(profile_path, 'History')
    if not os.path.exists(history_db):
        return []
    conn = sqlite3.connect(history_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT d.id, d.target_path, d.target_bytes, d.received_bytes,
               d.state, d.danger_type, d.interrupt_reason, d.opened,
               datetime((d.start_time / 1000000) - 11644473600, 'unixepoch', 'localtime'),
               datetime((d.finished_time / 1000000) - 11644473600, 'unixepoch', 'localtime'),
               duc.chain
        FROM downloads d
        LEFT JOIN (
            SELECT download_id, GROUP_CONCAT(url, ' -> ') AS chain
            FROM downloads_url_chains
            GROUP BY download_id
        ) duc ON d.id = duc.download_id
        ORDER BY d.start_time DESC
    ''')
    results = []
    for row in cursor.fetchall():
        did, path, target_bytes, recv_bytes, state, danger, interrupt, opened, start, end, chain = row
        results.append({
            'id': did,
            'target_path': path,
            'target_bytes': target_bytes,
            'received_bytes': recv_bytes,
            'state': state,
            'danger_type': danger,
            'interrupt_reason': interrupt,
            'opened': opened,
            'start_time': start,
            'end_time': end,
            'url_chain': chain
        })
    conn.close()
    return results

def export_to_csv(data, output_path):
    if not data:
        return
    keys = data[0].keys()
    with open(output_path, 'w', newline='', encoding='utf-8') as f:
        writer = csv.DictWriter(f, fieldnames=keys)
        writer.writeheader()
        writer.writerows(data)

def analyze_chrome_profile(profile_path, output_dir):
    os.makedirs(output_dir, exist_ok=True)
    history = extract_chrome_history(profile_path)
    export_to_csv(history, os.path.join(output_dir, 'chrome_history.csv'))
    cookies = extract_chrome_cookies(profile_path)
    export_to_csv(cookies, os.path.join(output_dir, 'chrome_cookies.csv'))
    downloads = extract_chrome_downloads(profile_path)
    export_to_csv(downloads, os.path.join(output_dir, 'chrome_downloads.csv'))
    summary = {
        'profile': profile_path,
        'history_entries': len(history),
        'cookie_entries': len(cookies),
        'download_entries': len(downloads)
    }
    with open(os.path.join(output_dir, 'summary.json'), 'w', encoding='utf-8') as f:
        json.dump(summary, f, indent=2, ensure_ascii=False)
    return summary

import sqlite3
import os
import json
import csv
from datetime import datetime

def firefox_timestamp_to_readable(ts):
    if ts == 0:
        return 'N/A'
    try:
        return datetime.utcfromtimestamp(ts / 1000000).strftime('%Y-%m-%d %H:%M:%S')
    except (ValueError, OSError):
        return 'INVALID'

def extract_firefox_history(profile_path):
    places_db = os.path.join(profile_path, 'places.sqlite')
    if not os.path.exists(places_db):
        return []
    conn = sqlite3.connect(places_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT p.url, p.title, p.visit_count, p.last_visit_date,
               hv.visit_type,
               datetime(hv.visit_date / 1000000, 'unixepoch', 'localtime')
        FROM moz_places p
        LEFT JOIN moz_historyvisits hv ON p.id = hv.place_id
        WHERE p.visit_count > 0
        ORDER BY hv.visit_date DESC
    ''')
    results = []
    for row in cursor.fetchall():
        url, title, visit_count, last_visit, visit_type, visit_time = row
        results.append({
            'url': url,
            'title': title,
            'visit_count': visit_count,
            'last_visit': firefox_timestamp_to_readable(last_visit or 0),
            'visit_type': visit_type,
            'visit_time': visit_time
        })
    conn.close()
    return results

def extract_firefox_cookies(profile_path):
    cookies_db = os.path.join(profile_path, 'cookies.sqlite')
    if not os.path.exists(cookies_db):
        return []
    conn = sqlite3.connect(cookies_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT host, name, value, path, expiry, isSecure, isHttpOnly,
               datetime(expiry, 'unixepoch', 'localtime'),
               datetime(lastAccessed / 1000000, 'unixepoch', 'localtime')
        FROM moz_cookies
        ORDER BY lastAccessed DESC
    ''')
    results = []
    for row in cursor.fetchall():
        host, name, value, path, expiry, secure, httponly, expiry_time, last_access = row
        results.append({
            'host': host,
            'name': name,
            'has_value': bool(value),
            'path': path,
            'expiry': expiry_time,
            'secure': bool(secure),
            'httponly': bool(httponly),
            'last_access': last_access
        })
    conn.close()
    return results

def extract_firefox_form_history(profile_path):
    form_db = os.path.join(profile_path, 'formhistory.sqlite')
    if not os.path.exists(form_db):
        return []
    conn = sqlite3.connect(form_db)
    cursor = conn.cursor()
    cursor.execute('''
        SELECT fieldname, value, timesUsed,
               datetime(firstUsed / 1000000, 'unixepoch', 'localtime'),
               datetime(lastUsed / 1000000, 'unixepoch', 'localtime')
        FROM moz_formhistory
        ORDER BY timesUsed DESC
    ''')
    results = []
    for row in cursor.fetchall():
        fieldname, value, times_used, first_used, last_used = row
        results.append({
            'fieldname': fieldname,
            'value': value,
            'times_used': times_used,
            'first_used': first_used,
            'last_used': last_used
        })
    conn.close()
    return results

def export_to_csv(data, output_path):
    if not data:
        return
    keys = data[0].keys()
    with open(output_path, 'w', newline='', encoding='utf-8') as f:
        writer = csv.DictWriter(f, fieldnames=keys)
        writer.writeheader()
        writer.writerows(data)

def analyze_firefox_profile(profile_path, output_dir):
    os.makedirs(output_dir, exist_ok=True)
    history = extract_firefox_history(profile_path)
    export_to_csv(history, os.path.join(output_dir, 'firefox_history.csv'))
    cookies = extract_firefox_cookies(profile_path)
    export_to_csv(cookies, os.path.join(output_dir, 'firefox_cookies.csv'))
    forms = extract_firefox_form_history(profile_path)
    export_to_csv(forms, os.path.join(output_dir, 'firefox_forms.csv'))
    summary = {
        'profile': profile_path,
        'history_entries': len(history),
        'cookie_entries': len(cookies),
        'form_entries': len(forms)
    }
    with open(os.path.join(output_dir, 'summary.json'), 'w', encoding='utf-8') as f:
        json.dump(summary, f, indent=2, ensure_ascii=False)
    return summary

#!/bin/bash

OUTPUT_DIR="$HOME/browser_forensics_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

echo "[+] Browser Forensics Collection Script"
echo "[+] Output directory: $OUTPUT_DIR"

collect_chrome_profiles() {
    local base_dirs=(
        "$HOME/Library/Application Support/Google/Chrome"
        "$HOME/.config/google-chrome"
        "$HOME/AppData/Local/Google/Chrome/User Data"
    )
    for dir in "${base_dirs[@]}"; do
        if [ -d "$dir" ]; then
            echo "[+] Found Chrome at: $dir"
            find "$dir" -maxdepth 1 -name "Default" -o -name "Profile *" | while read profile; do
                profile_name=$(basename "$profile")
                echo "[+] Processing Chrome profile: $profile_name"
                mkdir -p "$OUTPUT_DIR/chrome/$profile_name"
                for db in History "Cookies" "Login Data" "Web Data"; do
                    if [ -f "$profile/$db" ]; then
                        cp "$profile/$db" "$OUTPUT_DIR/chrome/$profile_name/" 2>/dev/null
                        echo "    Copied: $db"
                    fi
                done
                if [ -f "$profile/Preferences" ]; then
                    cp "$profile/Preferences" "$OUTPUT_DIR/chrome/$profile_name/" 2>/dev/null
                    echo "    Copied: Preferences"
                fi
                if [ -f "$profile/Local State" ]; then
                    cp "$dir/Local State" "$OUTPUT_DIR/chrome/$profile_name/" 2>/dev/null
                    echo "    Copied: Local State"
                fi
            done
        fi
    done
}

collect_firefox_profiles() {
    local base_dirs=(
        "$HOME/Library/Application Support/Firefox"
        "$HOME/.mozilla/firefox"
        "$HOME/AppData/Roaming/Mozilla/Firefox"
    )
    for dir in "${base_dirs[@]}"; do
        if [ -d "$dir" ]; then
            echo "[+] Found Firefox at: $dir"
            find "$dir" -maxdepth 1 -type d -name "*.default*" | while read profile; do
                profile_name=$(basename "$profile")
                echo "[+] Processing Firefox profile: $profile_name"
                mkdir -p "$OUTPUT_DIR/firefox/$profile_name"
                for db in places.sqlite cookies.sqlite formhistory.sqlite; do
                    if [ -f "$profile/$db" ]; then
                        cp "$profile/$db" "$OUTPUT_DIR/firefox/$profile_name/" 2>/dev/null
                        echo "    Copied: $db"
                    fi
                done
                if [ -f "$profile/logins.json" ]; then
                    cp "$profile/logins.json" "$OUTPUT_DIR/firefox/$profile_name/" 2>/dev/null
                    echo "    Copied: logins.json"
                fi
                if [ -f "$profile/key4.db" ]; then
                    cp "$profile/key4.db" "$OUTPUT_DIR/firefox/$profile_name/" 2>/dev/null
                    echo "    Copied: key4.db"
                fi
            done
        fi
    done
}

collect_edge_profiles() {
    local base_dirs=(
        "$HOME/Library/Application Support/Microsoft Edge"
        "$HOME/.config/microsoft-edge"
        "$HOME/AppData/Local/Microsoft/Edge/User Data"
    )
    for dir in "${base_dirs[@]}"; do
        if [ -d "$dir" ]; then
            echo "[+] Found Edge at: $dir"
            find "$dir" -maxdepth 1 -name "Default" -o -name "Profile *" | while read profile; do
                profile_name=$(basename "$profile")
                echo "[+] Processing Edge profile: $profile_name"
                mkdir -p "$OUTPUT_DIR/edge/$profile_name"
                for db in History "Cookies" "Login Data" "Web Data"; do
                    if [ -f "$profile/$db" ]; then
                        cp "$profile/$db" "$OUTPUT_DIR/edge/$profile_name/" 2>/dev/null
                        echo "    Copied: $db"
                    fi
                done
            done
        fi
    done
}

echo "[+] Collecting Chrome profiles..."
collect_chrome_profiles

echo "[+] Collecting Firefox profiles..."
collect_firefox_profiles

echo "[+] Collecting Edge profiles..."
collect_edge_profiles

echo "[+] Generating file hashes..."
find "$OUTPUT_DIR" -type f -exec sha256sum {} \; > "$OUTPUT_DIR/file_hashes.txt" 2>/dev/null

echo "[+] Collection complete. Output: $OUTPUT_DIR"
echo "[+] Total files collected: $(find "$OUTPUT_DIR" -type f | wc -l)"

title: Chrome History Database Access
id: b7c8d9e0-2001-0001-abcd-ef1234567801
status: experimental
description: 检测通过非浏览器进程访问 Chrome History 数据库的可疑行为
author: Security Team
date: 2026/07/01
references:
  - https://attack.mitre.org/techniques/T1005/
  - https://attack.mitre.org/techniques/T1213/
logsource:
  category: file_access
  product: windows
detection:
  selection_history:
    TargetFilename|endswith: '\History'
    TargetFilename|contains: '\Google\Chrome\User Data\'
  selection_login:
    TargetFilename|endswith: '\Login Data'
    TargetFilename|contains: '\Google\Chrome\User Data\'
  selection_cookie:
    TargetFilename|endswith: '\Cookies'
    TargetFilename|contains: '\Google\Chrome\User Data\'
  selection_firefox_places:
    TargetFilename|endswith: '\places.sqlite'
    TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
  selection_firefox_cookies:
    TargetFilename|endswith: '\cookies.sqlite'
    TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
  condition: selection_history or selection_login or selection_cookie or selection_firefox_places or selection_firefox_cookies
level: medium
tags:
  - attack.discovery
  - attack.t1005
  - attack.t1213

title: Browser History Cleared - Suspicious Timing
id: b7c8d9e0-2002-0001-abcd-ef1234567802
status: experimental
description: 检测在安全事件时间窗口内清除浏览器历史记录的可疑行为
author: Security Team
date: 2026/07/01
references:
  - https://attack.mitre.org/techniques/T1070/
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome_clear:
    Image|endswith: '\chrome.exe'
    CommandLine|contains:
      - '--clear-browser-data'
      - 'ClearBrowsingData'
  selection_edge_clear:
    Image|endswith: '\msedge.exe'
    CommandLine|contains:
      - '--clear-browser-data'
      - 'ClearBrowsingData'
  selection_firefox_clear:
    Image|endswith: '\firefox.exe'
    CommandLine|contains:
      - '-ClearPrivateData'
      - '-PlacesShutdownCleaner'
  selection_cmd_del_history:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
      - 'del'
      - 'History'
    CommandLine|contains:
      - '\Google\Chrome\User Data\'
      - '\Mozilla\Firefox\Profiles\'
      - '\Microsoft\Edge\User Data\'
  selection_powershell_remove_history:
    Image|endswith: '\powershell.exe' OR Image|endswith: '\pwsh.exe'
    CommandLine|contains:
      - 'Remove-Item'
    CommandLine|contains:
      - 'History'
      - 'places.sqlite'
  condition: selection_chrome_clear or selection_edge_clear or selection_firefox_clear or selection_cmd_del_history or selection_powershell_remove_history
level: high
tags:
  - attack.defense_evasion
  - attack.t1070

title: Browser Credential Database Accessed by Non-Browser Process
id: b7c8d9e0-2003-0001-abcd-ef1234567803
status: experimental
description: 检测非浏览器进程读取浏览器密码数据库的可疑行为
author: Security Team
date: 2026/07/01
references:
  - https://attack.mitre.org/techniques/T1555/
  - https://attack.mitre.org/techniques/T1003/
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\chrome.exe' OR
    TargetImage|endswith: '\msedge.exe' OR
    TargetImage|endswith: '\firefox.exe'
  filter_browser:
    SourceImage|endswith: '\chrome.exe' OR
    SourceImage|endswith: '\msedge.exe' OR
    SourceImage|endswith: '\firefox.exe' OR
    SourceImage|endswith: '\GoogleUpdate.exe' OR
    SourceImage|endswith: '\MicrosoftEdgeUpdate.exe' OR
    SourceImage|endswith: '\crashpad_handler.exe'
  condition: selection and not filter_browser
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1003

title: Suspicious Download from Known Malicious Domain
id: b7c8d9e0-2004-0001-abcd-ef1234567804
status: experimental
description: 检测从已知恶意域名下载文件的浏览器行为
author: Security Team
date: 2026/07/01
references:
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1204/
logsource:
  category: network_connection
  product: windows
detection:
  selection_chrome:
    Image|endswith: '\chrome.exe'
    DestinationHostname|endswith:
      - '.xyz'
      - '.top'
      - '.club'
      - '.buzz'
      - '.work'
      - '.click'
      - '.link'
  selection_edge:
    Image|endswith: '\msedge.exe'
    DestinationHostname|endswith:
      - '.xyz'
      - '.top'
      - '.club'
      - '.buzz'
      - '.work'
      - '.click'
      - '.link'
  condition: selection_chrome or selection_edge
level: medium
tags:
  - attack.initial_access
  - attack.t1189

title: Browser Extension Loaded from Non-Standard Path
id: b7c8d9e0-2005-0001-abcd-ef1234567805
status: experimental
description: 检测从非标准路径加载浏览器扩展的可疑行为
author: Security Team
date: 2026/07/01
references:
  - https://attack.mitre.org/techniques/T1176/
logsource:
  category: file_create
  product: windows
detection:
  selection_chrome_ext:
    TargetFilename|contains: '\Google\Chrome\User Data\Default\Extensions\'
    TargetFilename|endswith: '\manifest.json'
  selection_edge_ext:
    TargetFilename|contains: '\Microsoft\Edge\User Data\Default\Extensions\'
    TargetFilename|endswith: '\manifest.json'
  selection_firefox_ext:
    TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith: '.xpi'
  selection_temp_ext:
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
    TargetFilename|contains: 'extension'
    TargetFilename|endswith:
      - '.crx'
      - '.xpi'
      - '.manifest.json'
  condition: (selection_chrome_ext or selection_edge_ext or selection_firefox_ext) and selection_temp_ext
level: high
tags:
  - attack.persistence
  - attack.t1176