Web Browsers

A collection of 42 posts

Hindsight

Hindsight v2021.12

Hindsight v2021.12 adds parsing of more preference items, site settings (including HSTS records), Session Storage, and more!

Chrome

Cookies Database Moving in Chrome 96

To support stronger security for Chrome, some network-related files - including the Cookies database - are moving locations on disk.

Visualizations

Keystroke Flow from Chrome Omnibox

I take saved keystrokes from Chrome's Omnibox and graph them in a Sankey flow diagram.

Hindsight

New Hindsight Release: Better LevelDB parsing, New Web UI View, & More!

Latest Hindsight version (2021.01.16) brings exciting new features: improved LevelDB parsing (including deleted!), viewing Hindsight results in the web UI, and more!

Chrome

New "Media History" File Added to Chrome

There's a new database added in Chrome 86, dedicated to tracking media playback. Here's a first look at its contents!

Tools

Unfurl... in 3D

Unfurl has been a fun tool, but I've heard you: it's boring. This update to Unfurl will change all that!

Web Browsers

Google "ved" Parameter Versions

The "ved" parameter in Google URLs contains valuable link context. I've found a new version ("v2") with more info!

Tools Featured

Introducing Unfurl

Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL up into components, extracting as much information as it can from each piece, and presenting it

Web Browsers

Deciphering Browser Hieroglyphics: FileSystem (Part 3)

Part 3 in the Deciphering Browser Hieroglyphics series examines LevelDB databases and Chrome's FileSystem.

Web Browsers

Deciphering Browser Hieroglyphics: LocalStorage (Part 2)

The second post in "Deciphering Browser Hieroglyphics" discusses LocalStorage and using CyberChef to decode it.

Open Source Tools

Hindsight v2.4 Adds JSONL Output

Hindsight v2.4.0 add JSONL output, support for the newest versions of Chrome (1-76), and other small fixes.

Web Browsers

Deciphering Browser Hieroglyphics: Intro (Part 1)

In this first post in "Deciphering Browser Hieroglyphics" I introduce Chromotopia and our artifact deciphering approach.

Web Browsers

A First Look at Chromium-Based Edge

A quick (forensic) look at the new Chromium-based Edge web browser. TL;DR: it looks a lot like Chrome.

Open Source Tools

Hindsight v2.3 Finds and Parses Multiple Chrome Profiles

Hindsight v2.3.0 adds input path searching, parsing of LocalStorage LevelDB files, support for newer versions of Chrome (1-73), and minor fixes.

Web Browsers

Chrome Values Lookup Tables

I've fielded a few questions recently about what some value buried in a Chrome artifact means. I find myself going to the Hindsight source on GitHub and drilling down into the code because I know I have the values translated there. That seems kind of inefficient, so to

Chrome

Capturing Chrome's Evolution

When I was pretty fresh in the field of digital forensics, I picked this new thing called Google Chrome to dig into. There weren't a lot of tools out there that could parse it and I thought learning about browser history would be a useful skill for me.

Tools

Chrome Evolution

Show One Level Show Two Levels Show All Version: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Tools

Hindsight

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications - with more to come! Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache

Presentations & Interviews

Video of "Efficiently Summarizing Web Browsing Activity" at SANS DFIR Summit 2018

I spoke at the SANS DFIR Summit 2018 on "Efficiently Summarizing Web Browsing Activity" in Austin, TX. My abstract was: Reviewing web browsing activity is relevant in a wide variety of DFIR cases. With many users having multiple devices that may need to be analyzed, we need better

Presentations & Interviews

Ryan Benson Interviewed by BBC Click about Web Browsers

I was interviewed by BBC Click for their "What is GDPR?" episode. I'm not really sure what the personal information web browsers are storing on your computer has to do with the GDPR, but hey, I got to talk about browser forensics on TV so that

Open Source Tools

Hindsight v2.2 Parses More Chrome Preference Items

Hindsight v2.2.0 adds parsing of more preference items and support for newer versions of Chrome. The quick version is: * Support for Chrome versions 1 - 66 * Preference items with timestamps now are in the Timeline * Improvements to logging Both the GUI and command line versions of this release

Presentations & Interviews

Deciphering Browser Hieroglyphics

I spoke about "Deciphering Browser Hieroglyphics" at the SANS DFIR Summit 2017 in Austin, TX. I talked about how to "decipher" different kinds of information stored in web browsers, using a variety of open source tools. A recording of most of the talk is available YouTube

Open Source Tools

Hindsight v2 Adds a Web UI and Cache Parsing

Hindsight v2 is here! The new release brings new features, many of which are focused on ease-of-use, along with a refactoring of the code into a Python package pyhindsight. The highlights are: * Cross-platform web UI * Easier installation on all OSes - now just do pip install pyhindsight * Ability to parse

Web Browsers

Investigating Universal Analytics

Two common questions when investigating web browsing are: (1) how long did a user spend on a website, and (2) what actions did they take while on it? We have a number of methods of approximating what the user did and how much time they spent on a page, but

Web Browsers

Load Balancer Cookie Decoder

I was going through my bookmarks and found a write-up from a few years ago on decoding NetScaler load balancer cookies. Adam Maxwell (@catalyst256) wrote a few blog posts describing his process of figuring out how to decode the cookie and finished it off by releasing a Python script that