[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADKZ2Y7J66AAAE3JZT57AM":3,"skill-same:01M6ADKZ2Y7J66AAAE3JZT57AM":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ADKZ2Y7J66AAAE3JZT57AM","analyzing-browser-forensics-with-hindsight",null,"Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"analyzing browser forensics with hindsight","browser","forensics","edge","web-artifacts","downloads","cookies","browsing-history","chrome-forensics","hindsight","browser-forensics","xlsx","cache","content","artifacts","web","chromium","chrome","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-browser-forensics-with-hindsight\ndescription: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- browser-forensics\n- hindsight\n- chrome-forensics\n- chromium\n- edge\n- browsing-history\n- cookies\n- downloads\n- cache\n- web-artifacts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1217\n- T1539\n- T1555.003\n- T1185\n---\n\n# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session\u002Ftab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~\u002FLibrary\u002FApplication Support\u002FGoogle\u002FChrome\u002FDefault\u002F |\n| Chrome (Linux) | ~\u002F.config\u002Fgoogle-chrome\u002FDefault\u002F |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames\u002Fpasswords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage\u002F | HTML5 Local Storage per domain |\n| Session Storage\u002F | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"\u002Fpath\u002Fto\u002Fprofile\" -o \u002Foutput\u002Fanalysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http:\u002F\u002Flocalhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome\u002FWebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time\u002F1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cchrome_profile_path> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https:\u002F\u002Fgithub.com\u002Fobsidianforensics\u002Fhindsight\n- Chrome Forensics Guide: https:\u002F\u002Fallenace.medium.com\u002Fhindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https:\u002F\u002Fwww.cyberforensicacademy.com\u002Fblog\u002Fbrowser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https:\u002F\u002Fsource.chromium.org\u002Fchromium\u002Fchromium\u002Fsrc\u002F+\u002Fmain:components\u002Fhistory\u002F\n\n## Example Output\n\n```text\n$ python hindsight.py -i \u002Fevidence\u002Fchrome-profile -o \u002Fanalysis\u002Fhindsight_output\n\nHindsight v2024.01 - Chrome\u002FChromium Browser Forensic Analysis\n================================================================\n\nProfile: \u002Fevidence\u002Fchrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https:\u002F\u002Fmail.corporate.com\u002Finbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https:\u002F\u002Fdrive.google.com\u002Ffile\u002Fd\u002F1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https:\u002F\u002Fmega.nz\u002Ffolder\u002FxYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https:\u002F\u002Fmega.nz\u002Ffolder\u002FxYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https:\u002F\u002Fpastebin.com\u002Fraw\u002FkL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https:\u002F\u002F192.168.1.50:8443\u002Fadmin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https:\u002F\u002Ftransfer.sh\u002Fupload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https:\u002F\u002Fvpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https:\u002F\u002Fwhatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https:\u002F\u002Fprotonmail.com\u002Finbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https:\u002F\u002Fphish-domain.com\u002Fdocs\u002Freport     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https:\u002F\u002Fcdn.evil-updates.com\u002Fclient.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: \u002Fanalysis\u002Fhindsight_output\u002FHindsight_Report.xlsx\n```\n","# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session\u002Ftab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~\u002FLibrary\u002FApplication Support\u002FGoogle\u002FChrome\u002FDefault\u002F |\n| Chrome (Linux) | ~\u002F.config\u002Fgoogle-chrome\u002FDefault\u002F |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames\u002Fpasswords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage\u002F | HTML5 Local Storage per domain |\n| Session Storage\u002F | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"\u002Fpath\u002Fto\u002Fprofile\" -o \u002Foutput\u002Fanalysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http:\u002F\u002Flocalhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome\u002FWebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time\u002F1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cchrome_profile_path> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https:\u002F\u002Fgithub.com\u002Fobsidianforensics\u002Fhindsight\n- Chrome Forensics Guide: https:\u002F\u002Fallenace.medium.com\u002Fhindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https:\u002F\u002Fwww.cyberforensicacademy.com\u002Fblog\u002Fbrowser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https:\u002F\u002Fsource.chromium.org\u002Fchromium\u002Fchromium\u002Fsrc\u002F+\u002Fmain:components\u002Fhistory\u002F\n\n## Example Output\n\n```text\n$ python hindsight.py -i \u002Fevidence\u002Fchrome-profile -o \u002Fanalysis\u002Fhindsight_output\n\nHindsight v2024.01 - Chrome\u002FChromium Browser Forensic Analysis\n================================================================\n\nProfile: \u002Fevidence\u002Fchrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https:\u002F\u002Fmail.corporate.com\u002Finbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https:\u002F\u002Fdrive.google.com\u002Ffile\u002Fd\u002F1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https:\u002F\u002Fmega.nz\u002Ffolder\u002FxYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https:\u002F\u002Fmega.nz\u002Ffolder\u002FxYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https:\u002F\u002Fpastebin.com\u002Fraw\u002FkL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https:\u002F\u002F192.168.1.50:8443\u002Fadmin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https:\u002F\u002Ftransfer.sh\u002Fupload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https:\u002F\u002Fvpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https:\u002F\u002Fwhatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https:\u002F\u002Fprotonmail.com\u002Finbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https:\u002F\u002Fphish-domain.com\u002Fdocs\u002Freport     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https:\u002F\u002Fcdn.evil-updates.com\u002Fclient.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: \u002Fanalysis\u002Fhindsight_output\u002FHindsight_Report.xlsx\n```\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":7,"mitre_attack":57},[34,33,32,40,27,31,30,29,36,28],"mahipal","1.0",[53,54,55],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[58,59,60,61],"T1217","T1539","T1555.003","T1185","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-browser-forensics-with-hindsight",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-browser-forensics-with-hindsight",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-browser-forensics-with-hindsight",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-browser-forensics-with-hindsight","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002FSKILL.md",true,[86,92,97,103,107,111,117],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Ftemplate.md","ASSET","资产文件",438,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Fassets\u002Ftemplate.md",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",2761,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",594,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fworkflows.md",444,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Freferences\u002Fworkflows.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",9964,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Fscripts\u002Fagent.py",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fprocess.py",1597,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-browser-forensics-with-hindsight\u002Fscripts\u002Fprocess.py",[122,149,173,201,225,252],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[132,133,134,135,136,43,42,137,138,139,38,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,136,160,43,138,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,43,188,189,161,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,43,212,25,213,214,215,216,217,218,219,220,56,221,164,222,223,224],"windows","kape","triaging windows with kape","registry","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,43,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[136,260,43,261,262,263,264,265,266,267,268,196,269,197,270,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]