Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!Inthis series, we have been exploring how a forensic investigator can find evidence of illegal or illicit activity. Among other things, we have examined theregistryandprefetchfiles for artifacts and have done somerudimentary forensic analysis. For those of you who are seeking career as a forensic investigator or security engineer, this can be invaluable training. For hackers, it might be life-saving.In this tutorial, we will explore where and what the forensic investigator can find information about the activities of the suspect in their web browser. It's important to note that this information will vary by operating system and browser. Here we will look briefly at Internet Explorer and go into a bit more depth on Mozilla's Firefox.Internet ExplorerLet's begin with Microsoft's Internet Explorer. It is installed on every single Windows system as the default browser (except on newer versions of Window 10 whereEdgeis default, though IE isstill installed), so it is widely used. In many institutional and corporate environments, it is the only browser allowed.IE places its records in different places depending upon the version of Windows. Let's look at its recent versions since 2000 first.Windows 2000 & XPWe can get evidence of the user's internet activity in the following locations.%systemdir%\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.ie5%systemdir%\Documents and Settings\%username%\Cookies%systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5Windows Vista & 7The path of the files is slightly different beginning with Windows Vista and 7. We can find IE's files at:%systemdir%\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\%systemdir%\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Click or tap on image to expand to full size.Please note thatAppDataandTemporary Internet Filesare hidden files.Mozilla FirefoxWith Mozilla Firefox and its many variations (Iceweasel in Kali is one), most of the information is stored in SQLite databases. We can find those databases at different locations based upon the operating system.Below is the path to the database in Windows (XP, Vista, and 7), Linux, and Mac OS X.Windows XPC:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\<profile folder>\places.sqliteWindows Vista & 7C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile folder>\places.sqliteGNU/Linux/home/<user>/.mozilla/firefox/<profile folder>/places.sqliteMac OS X/Users/<user>/Library/Application Support/Firefox/Profiles/default.lov/places.sqliteMozilla uses a relational database to store the user's data, which has a structure like that below.Click or tap on image to expand to full size.Step 1: Using SQLite to Find Browser EvidenceSQLite is now being used by many browsers, applications, and mobile devices that require a small, lightweight relational database. Due to its lightweight nature, it is becoming increasingly popular among mobile devices and mobile apps. That being the case, it is critical that any competent forensic investigator become familiar with it as it is becoming very popular.To view or query the data in these SQLite databases, we will need a browser. You can download SQLite browserhere. If you are using Kali, the SQLite browser is preinstalled.Step 2: Load the Database File into the SQLite BrowserOnce you have installed the SQLite browser, navigate to the location specified above for the operating system you are investigating. In my case, its a Windows 7 system, so I navigate to:C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile folder>\You will see many files ending with "sqlite." These are the database tables that Mozilla uses to store the information on the user's browsing activities.Click or tap on image to expand to full size.Let's open that database in the SQLite browser. Next, click on the "Database Structure" tab to the far left. In the screenshot below, we can see all 13 tables in the database. Note that each table name begins with "moz."Click or tap on image to expand to full size.If we click on the "Browse Data" tab, the SQLite browser will display the data in the table we have selected. In the screenshot below, we are looking at "moz_anno_attributes."Click or tap on image to expand to full size.Now that we have a basic knowledge of the database structure, let's use some simple SQL queries to find specific and relevant data to our investigation.Step 3: Querying the DatabaseTo effectively use the SQLite browser to find eveidence, you need to know some basic SQL syntax. Take a look at my article on SQL in mydatabase hackingserieshere.Let's look in themoz_inputhistorytable for input that the user entered into the browser. Click on the "Execute SQL" tab to open a SQL query window. We could then write a general SQL query to find all the input data by entering:SELECT *FROM moz_inputhistoryAfter entering the query, click on the play (>) button to execute the query.Click or tap on image to expand to full size.As you can see, the suspect was typing some suspicious Google hacks using the keyword "inurl" and looking for admin directories. Hmm... we may be on to something here!Step 4: Finding Specific User InputLet's assume that this was a case where the employee is suspected of having downloaded pirated files from a torrenting site (in many companies and institutions this is prohibited activity, and in many countries it is illegal). We could be very specific in our SQL query to find where the suspect may have input "tor." We could find every occurrence where they typed "tor" querying the input history with:SELECT *FROM moz_inputhistoryWHERE input like '%tor%'This query will provide us all columns (SELECT *) from the input history table (FROM moz_inputhistory) where the typed input is like "tor" (WHERE input like '%tor%'). Note the wildcards (%) before and aftertor. This indicates that we are looking for anything before tor and anything after tor.This query should provide us with results of any input by the user that has "tor" anywhere in it.Click or tap on image to expand to full size.As you can see in the screenshot above, we were able to find two occurrences where the suspect/user had input "tor." This may be enough evidence to prove that the suspect was actually looking for torrent sites, but we may want to dig a bit deeper to actually find the URLs of the sites in his places history (moz_places table).Keep coming back, my novice hackers, as we continue to explorethe skills and techniquesof the forensic investigator!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)How To:Why You Should Study to Be a HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)News:What to Expect from Null Byte in 2015Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)News:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyNews:Becoming a HackerHack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)How To:Recover deleted text messages on an iPhoneHow To:Adobe Flash Player Is Bad for Your Computer (Here's How You Uninstall It)How To:Don't Get Caught! How to Protect Your Hard Drives from Data Forensics