Difference between pages "Network forensics" and "Mozilla Firefox"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Open Source Network Forensics)
 
(See Also)
 
Line 1: Line 1:
'''Network forensics''' is the process of capturing information that moves over a [[network]] and trying to make sense of it in some kind of forensics capacity. A [[network forensics appliance]] is a device that automates this process.
+
{{expand}}
 +
Mozilla Firefox is a Free and Open Source [[Web Browser|web browser]] developed by the Mozilla Foundation.
  
There are both open source and proprietary network forensics systems available.
+
It can have many [http://addons.mozilla.org add-ons] which give it extra capabilities.
  
== Overview ==
+
== Anonymous Browsing ==
 +
Mozilla Firefox can be used in anonymous browsing (see [[The Onion Router]]). However, it is known that Firefox reveals computer's uptime in TLS (SSL) "Client Hello" packets allowing investigator correlate anonymous and non-anonymous traffic [http://archives.seul.org/or/talk/Apr-2008/msg00050.html].
  
<!--
+
This bug affects Firefox 2 (all versions) and Firefox 3 Beta3.
  
  PLEASE DO NOT ADD ENTRIES THAT DO NOT HAVE AN ARTICLE.
+
== History ==
 +
Firefox 3 stores the history of visited sites in a file named '''places.sqlite'''. This file uses the [[SQLite database format]].
  
  Please keep these in alphabetical order.
+
'''places.sqlite''' can be found in the following locations:
  
  When updating any table, please update all tables as appropriate.
+
On Linux
 +
<pre>
 +
/home/$USER/.mozilla/firefox/$PROFILE.default/places.sqlite
 +
</pre>
  
-->
+
On MacOS-X
 +
<pre>
 +
/Users/$USER/Library/Application Support/Firefox/Profiles/$PROFILE.default/places.sqlite
 +
</pre>
  
{| class="wikitable sortable" style="width: auto; font-size: smaller"
+
On Windows XP
|-
+
<pre>
! System
+
C:\Documents and Settings\%USERNAME%\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite
! [[software license|License]]
+
</pre>
! User Interface
+
! Supported Platform
+
! Supported Protocols
+
! class="unsortable" | Refs <!-- This column is for a general reference and does not replace the need to identify references for specific features if the feature is not explained in the general reference -->
+
|
+
|
+
|-
+
| [[Argus]]
+
| [[Open Source]]
+
| Command Line, GUI via [http://www.datenspionage.de/arguseye/ ArgusEye]
+
| Mac OS X, Linux, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, IRIX, Windows (under Cygwin) and OpenWrt
+
| L2 addresses, tunnel identifiers (MPLS, GRE, ESP, etc...), protocol ids, SAP's, hop-count, options, L4 transport identification (RTP, RTCP detection), host flow control indication; netflow
+
|
+
|
+
|-
+
| [[Chaosreader]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Solaris, RedHat, Windows
+
| FTP files, HTTP transfers (HTML, GIF, JPEG, ...), SMTP emails, ... from the captured data inside network traffic logs
+
|
+
|
+
|-
+
| [[DataEcho]]
+
| [[Open Source]]
+
| GUI
+
| Windows
+
| www, http
+
|
+
|
+
|-
+
| [[Junkie]]
+
| [[Open Source]]
+
| GUI
+
| unknown
+
| unknown
+
|
+
|
+
|-
+
| [[kisMAC]]
+
| [[Open Source]]
+
| GUI
+
| Mac OS X, Linux, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, IRIX, Windows (under Cygwin) and OpenWrt
+
| L2 addresses, tunnel identifiers (MPLS, GRE, ESP, etc...), protocol ids, SAP's, hop-count, options, L4 transport identification (RTP, RTCP detection), host flow control indication; netflow
+
|
+
|
+
|-
+
| [[kismet]]
+
| [[Open Source]]
+
| Command Line /GUI via [http://www.datenspionage.de/arguseye/ ArgusEye]
+
| Mac OS X
+
| unknown
+
|
+
|-
+
| [[n2disk]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Ubuntu, CentOS
+
| unknown
+
|
+
|
+
|-
+
| [[net-sniff-ng]]
+
| [[Open Source]]
+
| unknown
+
| unknown
+
| unknown
+
|
+
|
+
|-
+
| [[netfse]]
+
| [[Open Source]]
+
| GUI
+
| unknown
+
| TCP/IP, UDP
+
|
+
|
+
|-
+
| [[netsleuth]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows, [[Backtrack]]
+
| Apple MDNS / Bonjour, SMB / CIFS / NetBios, DHCP (using the www.fingerbank.org resource), SSDP (as used in Microsoft Zero Config)
+
|
+
|
+
|-
+
| [[NetworkMiner]]
+
| [[Open Source]]
+
| Windows GUI, Commandline
+
| Linux / Mac OS X / FreeBSD, Windows
+
| http, smb, ftp, tfpt, ssl , tls, tor
+
|
+
|
+
|-
+
| [[ntop]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Unix (including Linux, *BSD, Solaris, and MacOSX), linux, windows
+
| DPI via OpenDPI Library; FTP POP SMTP IMAP DNS IPP HTTP MDNS NTP NFS SSDP BGP SNMP XDMCP SMB SYSLOG DHCP PostgreSQL MySQL TDS DirectDownloadLink I23V5 AppleJuice DirectConnect Socrates WinMX MANOLITO PANDO Filetopia iMESH Kontiki OpenFT Kazaa/Fasttrack Gnutella eDonkey Bittorrent (Extended) OFF AVI Flash OGG MPEG QuickTime RealMedia Windowsmedia MMS XBOX QQ MOVE RTSP Feidian Icecast PPLive PPStream Zattoo SHOUTCast SopCast TVAnts TVUplayer VeohTV QQLive Thunder/Webthunder Soulseek GaduGadu IRC Popo Jabber MSN Oscar Yahoo Battlefield Quake Second Life Steam Halflife2 World of Warcraft Telnet STUN IPSEC GRE ICMP IGMP EGP SCTP OSPF IP in IP RTP RDP VNC PCAnywhere SSL SSH USENET MGCP IAX TFTP
+
|
+
|
+
|
+
|-
+
| [[OSSEC]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows 7, XP, 2000 and Vista Windows Server 2003 and 2008 VMWare ESX 3.0,3.5 (including CIS checks) FreeBSD (all versions) OpenBSD (all versions) NetBSD (all versions) Solaris 2.7, 2.8, 2.9 and 10 AIX 5.3 and 6.1 HP-UX 10, 11, 11i MacOSX 10 remote syslog: Cisco PIX, ASA and FWSM (all versions) Cisco IOS routers (all versions) Juniper Netscreen (all versions) SonicWall firewall (all versions) Checkpoint firewall (all versions) Cisco IOS IDS/IPS module (all versions) Sourcefire (Snort) IDS/IPS (all versions) Dragon NIDS (all versions) Checkpoint Smart Defense (all versions) McAfee VirusScan Enterprise (v8 and v8.5) Bluecoat proxy (all versions) Cisco VPN concentrators (all versions) Database monitoring is available for the following systems: MySQL (all versions) PostgreSQL (all versions) Oracle, MSSQL (to be available soon)"
+
| Unknown
+
|
+
|
+
|-
+
| [[Snort]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Linux, Windows
+
| Unknown
+
|
+
|
+
|-
+
| [[Wireshark]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, and others
+
| IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2; Wireshark can decrypt IEEE 802.11 WLAN data with user specified encryption keys, and others
+
|
+
|
+
|-
+
| [[xplico]]
+
| [[Open Source]]
+
| Unknown
+
| Unknown
+
| ARP Radiotap Ethernet PPP VLAN L2TP IPv4 IPv6 TCP UDP DNS HTTP SMTP POP IMAP SIP MGCP H323 RTP RTCP SDP FB chat FTP IPP CHDLC PJL NNTP MSN IRC YAHOO GTALK EMULE SSL/TLS IPsec 802.11 LLC MMSE Linux cooked TFTP SNOOP PPPoE Telnet WebMail Paltalk Exp. Paltalk NetBIOS SMB PPI syslog G711ulaw, G711alaw, G722, G729, G723, G726 and RTAudio (x-msrta: Real Time Audio).
+
| Unknown
+
|
+
|
+
|- class="sortbottom"
+
! System
+
! [[software license|License]]
+
! User Interface
+
! Supported Platform
+
! Supported Protocols
+
! class="unsortable" | Refs <!-- This column is for a general reference and does not replace the need to identify references for specific features if the feature is not explained in the general reference -->
+
|}
+
  
== Open Source Network Forensics ==
+
On Windows Vista, 7
* [[Argus]]
+
<pre>
* [[Bulk Extractor]] [https://github.com/simsong/bulk_extractor]
+
C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite
* [[Chaosreader]] is a session reconstruction tool (supports both live or captured network traffic)
+
</pre>
* [[DataEcho]]
+
* [[Flow GREP]] flowgrep is a basic IDS/IPS tool written in python [http://www.monkey.org/~jose/software/flowgrep/]
+
* [[KisMAC]] is a free, open source wireless stumbling and security tool for Mac OS X. [http://kismac-ng.org]
+
* [[Kismet]]
+
* [[logstash]] logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. [http://logstash.net/]
+
  
* [[log2Timeline]] a framework for automatic creation of a super timeline. The main purpose is to provide a single tool to parse various log files and artifacts found on suspect systems (and supporting systems, such as network equipment) and produce a timeline that can be analysed by forensic investigators/analysts. [https://code.google.com/p/log2timeline/]
+
=== Timestamps ===
* [[NetFSE]] is a web-based search and analysis application for high-volume network data [http://www.netfse.org available at NetFSE.org]
+
The places.sqlite uses the following timestamps.
* [http://www.netgrab.co.uk NetSleuth] is a live and retrospective network analysis and triage tool.
+
* [[ntop]]
+
* [[Net GREP]] Netgrep is a command line tool which tells you which lines in a text file contain network resources related to a particular country or Autonomous Network (AS) [https://pypi.python.org/pypi/netgrep/]
+
* [[NetworkMiner]] is [http://sourceforge.net/apps/mediawiki/networkminer/index.php?title=NetworkMiner an open source Network Forensics Tool available at SourceForge]
+
* [[OSSEC]]
+
* [[plaso]] Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines [http://plaso.kiddaland.net/]
+
  
* [[RegRipper]]  RegRipper is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis [http://regripper.wordpress.com/]
+
The '''moz_historyvisits.visit_date''' is in (the number of) microseconds since January 1, 1970 UTC
* [[Snort]]
+
* [[Wireshark]]
+
* [[Xplico]] is an Internet/IP Traffic Decoder (NFAT). Protocols supported: [http://www.xplico.org/status.html HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...]
+
  
== Commercial Network Forensics ==
+
Some Python code to do the conversion into human readable format:
 +
<pre>
 +
date_string = datetime.datetime( 1970, 1, 1 )
 +
            + datetime.timedelta( microseconds=timestamp )
 +
</pre>
  
===Deep-Analysis Systems===
+
=== Example queries ===
* Code Green Networks [http://www.codegreennetworks.com Content Inspection Appliance] - Passive monitoring and mandatory proxy mode. Easy to use Web GUI. Linux platform. Uses Stellent Outside In to access document content and metadata.
+
Some example queries:
* E-Detective [http://www.edecision4u.com/] [http://www.digi-forensics.com/home.html]
+
* [http://www.infowatch.com InfoWatch Traffic Monitor]
+
* Mera Systems [http://netbeholder.com/ NetBeholder]
+
* MFI Soft [http://sormovich.ru/ SORMovich] (in Russian)
+
* Solera Networks - Provider of full packet capture network forensics appliances [http://www.soleranetworks.com/ Solera Networks]
+
* NETRESEC [http://www.netresec.com/?page=NetworkMiner NetworkMiner Professional (portable network forensic analysis tool for Windows)]
+
* NetWitness Corporation - Freeware/Commercial, Enterprise-Wide, Real-Time Network Forensics [http://www.netwitness.com/ NetWitness]
+
* Network Instruments [http://www.networkinstruments.com/]
+
* NIKSUN's [[NetDetector]]
+
* PacketMotion [http://www.packetmotion.com/]
+
* Sandstorm's [http://www.sandstorm.net/products/netintercept/ NetIntercept] - Passive monitoring appliance. Qt/X11 GUI. FreeBSD platform. Uses forensic parsers written by Sandstorm to access document content and metadata.
+
* WildPackets [[OmniPeek]] [http://www.wildpackets.com/solutions/it_solutions/network_forensics] [http://www.wildpackets.com/products/distributed_network_analysis/omnipeek_network_analyzer/forensics_search]
+
  
===Flow-Based Systems===
+
To get an overview of the visited sites:
* Arbor Networks
+
<pre>
* GraniteEdge Networks
+
SELECT datetime(moz_historyvisits.visit_date/1000000, 'unixepoch', 'localtime'), moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id;
* Lancope http://www.lancope.com/
+
</pre>
* Mantaro Product Development Services http://www.mantaro.com/products/MNIS/index.htm
+
* Mazu Networks http://www.mazunetworks.com/
+
  
===Hybrid Systems===
+
== Downloads ==
These systems combine flow analysis, deep analysis, and security event monitoring and reporting.
+
Firefox 3 stores the history of downloads sites in a file named '''downloads.sqlite'''. This file uses the [[SQLite database format]].
* Q1 Labs  http://www.q1labs.com/
+
  
== Tips and Tricks ==
+
'''downloads.sqlite''' can be found in the same location as '''places.sqlite'''.
  
* The time between two events triggered by an intruder (as seen in logfiles, for example) can be helpful. If it is very short, you can be pretty sure that the actions were performed by an automated script and not by a human user.
+
'''Note it looks that Firefox 21 (or earlier?) stores the downloads as part of the bookmarks in moz_bookmarks and moz_annos in places.sqlite'''
  
== See also ==
+
=== Timestamps ===
* [[Wireless forensics]]
+
The places.sqlite uses the following timestamps.
* [[SSL forensics]]
+
  
* [[IP geolocation]]
+
The '''moz_downloads.startTime''' and '''moz_downloads.endTime''' are in (the number of) microseconds since January 1, 1970 UTC.
* [[Tools:Network Forensics]]
+
* [[Tools:Logfile Analysis]]
+
  
[[Category:Network Forensics]]
+
=== Example queries ===
 +
Some example queries:
 +
 
 +
To get an overview of the downloaded files:
 +
<pre>
 +
SELECT moz_downloads.startTime, moz_downloads.source, moz_downloads.currBytes, moz_downloads.maxBytes FROM moz_downloads;
 +
</pre>
 +
 
 +
== Cache ==
 +
On Linux
 +
<pre>
 +
/home/$USER/.mozilla/firefox/$PROFILE.default/Cache/
 +
</pre>
 +
 
 +
On MacOS-X
 +
<pre>
 +
/Users/$USER/Library/Caches/Firefox/Profiles/$PROFILE.default/Cache/
 +
</pre>
 +
 
 +
On Windows XP
 +
<pre>
 +
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\
 +
</pre>
 +
 
 +
On Windows Vista, 7
 +
<pre>
 +
C:\Users\%USERNAME%\AppData\Local\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\
 +
</pre>
 +
 
 +
== See Also ==
 +
 
 +
* [[Mozilla Firefox History File Format]]
 +
* [[SQLite database format]]
 +
 
 +
== External Links ==
 +
 
 +
* [http://www.mozilla.com/firefox/ Official website]
 +
* [http://kb.mozillazine.org/Profile_folder_-_Firefox Profile folder - Firefox]
 +
* [https://wiki.mozilla.org/images/3/3d/Downloads.sqlite.schema.pdf Firefox 3 – downloads.sqlite]
 +
* [http://download.cdn.mozilla.net/pub/firefox/releases/ Mozilla Firefox Releases]
 +
 
 +
[[Category:Applications]]
 +
[[Category:Web Browsers]]

Revision as of 04:47, 22 September 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Mozilla Firefox is a Free and Open Source web browser developed by the Mozilla Foundation.

It can have many add-ons which give it extra capabilities.

Anonymous Browsing

Mozilla Firefox can be used in anonymous browsing (see The Onion Router). However, it is known that Firefox reveals computer's uptime in TLS (SSL) "Client Hello" packets allowing investigator correlate anonymous and non-anonymous traffic [1].

This bug affects Firefox 2 (all versions) and Firefox 3 Beta3.

History

Firefox 3 stores the history of visited sites in a file named places.sqlite. This file uses the SQLite database format.

places.sqlite can be found in the following locations:

On Linux

/home/$USER/.mozilla/firefox/$PROFILE.default/places.sqlite

On MacOS-X

/Users/$USER/Library/Application Support/Firefox/Profiles/$PROFILE.default/places.sqlite

On Windows XP

C:\Documents and Settings\%USERNAME%\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite

On Windows Vista, 7

C:\Users\%USERNAME%\AppData\Roaming\Mozilla\Firefox\Profiles\%PROFILE%.default\places.sqlite

Timestamps

The places.sqlite uses the following timestamps.

The moz_historyvisits.visit_date is in (the number of) microseconds since January 1, 1970 UTC

Some Python code to do the conversion into human readable format:

date_string = datetime.datetime( 1970, 1, 1 )
            + datetime.timedelta( microseconds=timestamp )

Example queries

Some example queries:

To get an overview of the visited sites:

SELECT datetime(moz_historyvisits.visit_date/1000000, 'unixepoch', 'localtime'), moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id;

Downloads

Firefox 3 stores the history of downloads sites in a file named downloads.sqlite. This file uses the SQLite database format.

downloads.sqlite can be found in the same location as places.sqlite.

Note it looks that Firefox 21 (or earlier?) stores the downloads as part of the bookmarks in moz_bookmarks and moz_annos in places.sqlite

Timestamps

The places.sqlite uses the following timestamps.

The moz_downloads.startTime and moz_downloads.endTime are in (the number of) microseconds since January 1, 1970 UTC.

Example queries

Some example queries:

To get an overview of the downloaded files:

SELECT moz_downloads.startTime, moz_downloads.source, moz_downloads.currBytes, moz_downloads.maxBytes FROM moz_downloads;

Cache

On Linux

/home/$USER/.mozilla/firefox/$PROFILE.default/Cache/

On MacOS-X

/Users/$USER/Library/Caches/Firefox/Profiles/$PROFILE.default/Cache/

On Windows XP

C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\

On Windows Vista, 7

C:\Users\%USERNAME%\AppData\Local\Mozilla\Firefox\Profiles\%PROFILE%.default\Cache\

See Also

External Links