`dissect.target.plugins.apps.browser.firefox`¶

Module Contents¶

Classes¶

FirefoxPlugin

Firefox browser plugin.

Functions¶

`decrypt_master_key`	Retrieve and decrypt the master key from the Firefox NSS database.
`decrypt_value`	Decrypt an encrypted value using the decrypted master key and algorithm.

Attributes¶

`HAS_ASN1`
`HAS_CRYPTO`
`FIREFOX_EXTENSION_RECORD_FIELDS`
`log`
`pbeWithSha1AndTripleDES_CBC`
`CKA_ID`

dissect.target.plugins.apps.browser.firefox.HAS_ASN1 = True¶

dissect.target.plugins.apps.browser.firefox.HAS_CRYPTO = True¶

dissect.target.plugins.apps.browser.firefox.FIREFOX_EXTENSION_RECORD_FIELDS = [('uri', 'source_uri'), ('string[]', 'optional_permissions')]¶

dissect.target.plugins.apps.browser.firefox.log¶

class dissect.target.plugins.apps.browser.firefox.FirefoxPlugin(target: dissect.target.target.Target)¶

Bases: dissect.target.plugins.apps.browser.browser.BrowserPlugin

Firefox browser plugin.

__namespace__ = 'firefox'¶: Defines the plugin namespace.

USER_DIRS = ('AppData/Roaming/Mozilla/Firefox/Profiles', 'AppData/local/Mozilla/Firefox/Profiles',...¶

SYSTEM_DIRS = ('/data/data/org.mozilla.vrbrowser/files/mozilla',)¶

BrowserHistoryRecord¶

BrowserCookieRecord¶

BrowserDownloadRecord¶

BrowserExtensionRecord¶

BrowserPasswordRecord¶

installs¶

find_installs() → collections.abc.Iterator[tuple[dissect.target.plugins.general.users.UserDetails | None, pathlib.Path]]¶: Find Firefox install directories on the target.

check_compatible() → None¶

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:: UnsupportedPluginError – If the plugin could not be loaded.

history() → collections.abc.Iterator[BrowserHistoryRecord]¶

Return browser history records from Firefox.

Yields BrowserHistoryRecord with the following fields:

ts (datetime): Visit timestamp.
browser (string): The browser from which the records are generated from.
id (string): Record ID.
url (uri): History URL.
title (string): Page title.
description (string): Page description.
host (string): Hostname.
visit_type (varint): Visit type.
visit_count (varint): Amount of visits.
hidden (string): Hidden value.
typed (boolean): Typed value.
session (varint): Session value.
from_visit (varint): Record ID of the "from" visit.
from_url (uri): URL of the "from" visit.
source: (path): The source file of the history record.

cookies() → collections.abc.Iterator[BrowserCookieRecord]¶

Return browser cookie records from Firefox.

Parameters:: browser_name – The name of the browser as a string.

Yields:

Records with the following fields:
    ts_created (datetime): Cookie created timestamp.
    ts_last_accessed (datetime): Cookie last accessed timestamp.
    browser (string): The browser from which the records are generated from.
    name (string): The cookie name.
    value (string): The cookie value.
    host (string): Cookie host key.
    path (string): Cookie path.
    expiry (varint): Cookie expiry.
    is_secure (bool): Cookie secury flag.
    is_http_only (bool): Cookie http only flag.
    same_site (bool): Cookie same site flag.

downloads() → collections.abc.Iterator[BrowserDownloadRecord]¶

Return browser download records from Firefox.

Yields BrowserDownloadRecord with the following fields:

ts_start (datetime): Download start timestamp.
ts_end (datetime): Download end timestamp.
browser (string): The browser from which the records are generated from.
id (string): Record ID.
path (string): Download path.
url (uri): Download URL.
size (varint): Download file size.
state (varint): Download state number.
source: (path): The source file of the download record.

extensions() → collections.abc.Iterator[BrowserExtensionRecord]¶

Return browser extension records for Firefox.

Yields BrowserExtensionRecord with the following fields:

ts_install (datetime): Extension install timestamp.
ts_update (datetime): Extension update timestamp.
browser (string): The browser from which the records are generated.
id (string): Extension unique identifier.
name (string): Name of the extension.
short_name (string): Short name of the extension.
default_title (string): Default title of the extension.
description (string): Description of the extension.
version (string): Version of the extension.
ext_path (path): Relative path of the extension.
from_webstore (boolean): Extension from webstore.
permissions (string[]): Permissions of the extension.
manifest (varint): Version of the extensions' manifest.
optional_permissions (string[]): Optional permissions of the extension.
source_uri (path): Source path from which the extension was downloaded.
source (path): The source file of the download record.

passwords() → collections.abc.Iterator[BrowserPasswordRecord]¶

Return Firefox browser password records.

Automatically decrypts passwords from Firefox 58 onwards (2018) if no primary password is set. Alternatively, you can supply a primary password through the keychain to access the Firefox password store.

Passphrases in the keychain with providers browser, firefox, user and no provider can be used to decrypt secrets for this plugin.

References

dissect.target.plugins.apps.browser.firefox.pbeWithSha1AndTripleDES_CBC = '1.2.840.113549.1.12.5.1.3'¶

dissect.target.plugins.apps.browser.firefox.CKA_ID¶

dissect.target.plugins.apps.browser.firefox.decrypt_master_key(key4_file: pathlib.Path, primary_password: bytes) → bytes¶

Retrieve and decrypt the master key from the Firefox NSS database.

Parameters:

key4_file – Path object to the key4.db file.
primary_password – bytes of the Firefox primary password.

Raises:

ValueError if retrieval or decryption of master key fails. –

Returns:

32 byte or 24 byte long decrypted and unpadded master key for AES or 3DES operations.

dissect.target.plugins.apps.browser.firefox.decrypt_value(b64_ciphertext: str, key: bytes) → bytes | None¶

Decrypt an encrypted value using the decrypted master key and algorithm.