[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEREMMA9TBWBT223RCHQZ2":3,"skill-same:01M6AEREMMA9TBWBT223RCHQZ2":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AEREMMA9TBWBT223RCHQZ2","extracting-browser-history-artifacts",null,"Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView). Use when performing digital forensics or incident response on a disk image or live system and you need timeline evidence of a user's web activity.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"extracting browser history artifacts","artifacts","browser","forensics","artifact-extraction","web-history","t1059","Tools","digital-forensics","downloads","cookies","hindsight","image","edge","cache","web","firefox","chrome","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: extracting-browser-history-artifacts\ndescription: Extracts and analyzes browser history, cookies, cache, downloads, and\n  bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite,\n  Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView).\n  Use when performing digital forensics or incident response on a disk image or\n  live system and you need timeline evidence of a user's web activity.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- browser-forensics\n- chrome\n- firefox\n- edge\n- web-history\n- artifact-extraction\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Extracting Browser History Artifacts\n\n## When to Use\n- When investigating user web activity as part of a forensic examination\n- During insider threat investigations to establish patterns of data exfiltration\n- When tracing user visits to malicious or policy-violating websites\n- For correlating browser activity with other forensic artifacts and timelines\n- When investigating phishing attacks to identify which links were clicked\n\n## Prerequisites\n- Forensic image or access to user profile directories\n- SQLite3 for querying browser databases\n- Hindsight, BrowsingHistoryView, or DB Browser for SQLite\n- Knowledge of browser artifact file locations per OS\n- Python 3 with sqlite3 module for automated extraction\n- Understanding of Chrome, Firefox, and Edge storage formats\n\n## Workflow\n\n### Step 1: Locate Browser Artifact Files\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Chrome artifact locations (Windows)\nCHROME_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FLocal\u002FGoogle\u002FChrome\u002FUser Data\u002FDefault\"\n# Key files: History, Cookies, Login Data, Web Data, Bookmarks, Preferences,\n#            Cache\u002F, GPUCache\u002F, Local Storage\u002F, Session Storage\u002F, IndexedDB\u002F\n\n# Firefox artifact locations (Windows)\nFIREFOX_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FRoaming\u002FMozilla\u002FFirefox\u002FProfiles\u002F*.default-release\"\n# Key files: places.sqlite, cookies.sqlite, formhistory.sqlite, logins.json,\n#            key4.db, sessionstore.jsonlz4, webappsstore.sqlite\n\n# Edge (Chromium) artifact locations (Windows)\nEDGE_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FLocal\u002FMicrosoft\u002FEdge\u002FUser Data\u002FDefault\"\n\n# Copy artifacts to working directory\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002F{chrome,firefox,edge}\ncp -r \"$CHROME_WIN\"\u002F{History,Cookies,Downloads,\"Login Data\",\"Web Data\",Bookmarks} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F 2>\u002Fdev\u002Fnull\ncp -r $FIREFOX_WIN\u002F{places.sqlite,cookies.sqlite,formhistory.sqlite,logins.json} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002F 2>\u002Fdev\u002Fnull\ncp -r \"$EDGE_WIN\"\u002F{History,Cookies,Downloads} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fedge\u002F 2>\u002Fdev\u002Fnull\n\n# Hash artifacts for integrity\nfind \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002F -type f -exec sha256sum {} \\; \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fartifact_hashes.txt\n```\n\n### Step 2: Extract Chrome Browsing History and Downloads\n\n```bash\n# Query Chrome History database\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_history.csv\n\nSELECT\n    urls.url,\n    urls.title,\n    datetime(urls.last_visit_time\u002F1000000-11644473600, 'unixepoch') AS last_visit,\n    urls.visit_count,\n    urls.typed_count,\n    visits.transition & 0xFF AS transition_type\nFROM urls\nLEFT JOIN visits ON urls.id = visits.url\nORDER BY urls.last_visit_time DESC;\nSQL\n\n# Extract Chrome downloads\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_downloads.csv\n\nSELECT\n    current_path,\n    tab_url AS source_url,\n    total_bytes,\n    datetime(start_time\u002F1000000-11644473600, 'unixepoch') AS start_time,\n    datetime(end_time\u002F1000000-11644473600, 'unixepoch') AS end_time,\n    state,\n    danger_type,\n    mime_type\nFROM downloads\nORDER BY start_time DESC;\nSQL\n\n# Extract Chrome search terms\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_searches.csv\n\nSELECT\n    term,\n    urls.url,\n    datetime(urls.last_visit_time\u002F1000000-11644473600, 'unixepoch') AS search_time\nFROM keyword_search_terms\nJOIN urls ON keyword_search_terms.url_id = urls.id\nORDER BY urls.last_visit_time DESC;\nSQL\n```\n\n### Step 3: Extract Firefox Browsing History\n\n```bash\n# Query Firefox places.sqlite for history\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fplaces.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_history.csv\n\nSELECT\n    moz_places.url,\n    moz_places.title,\n    datetime(moz_historyvisits.visit_date\u002F1000000, 'unixepoch') AS visit_date,\n    moz_places.visit_count,\n    moz_historyvisits.visit_type\nFROM moz_places\nJOIN moz_historyvisits ON moz_places.id = moz_historyvisits.place_id\nORDER BY moz_historyvisits.visit_date DESC;\nSQL\n\n# Extract Firefox bookmarks\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fplaces.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_bookmarks.csv\n\nSELECT\n    moz_bookmarks.title,\n    moz_places.url,\n    datetime(moz_bookmarks.dateAdded\u002F1000000, 'unixepoch') AS date_added,\n    datetime(moz_bookmarks.lastModified\u002F1000000, 'unixepoch') AS last_modified\nFROM moz_bookmarks\nJOIN moz_places ON moz_bookmarks.fk = moz_places.id\nWHERE moz_bookmarks.type = 1\nORDER BY moz_bookmarks.dateAdded DESC;\nSQL\n\n# Extract Firefox form history (search terms, form fills)\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fformhistory.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_forms.csv\n\nSELECT\n    fieldname,\n    value,\n    timesUsed,\n    datetime(firstUsed\u002F1000000, 'unixepoch') AS first_used,\n    datetime(lastUsed\u002F1000000, 'unixepoch') AS last_used\nFROM moz_formhistory\nORDER BY lastUsed DESC;\nSQL\n```\n\n### Step 4: Extract Cookies and Stored Credentials\n\n```bash\n# Extract Chrome cookies\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FCookies \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_cookies.csv\n\nSELECT\n    host_key,\n    name,\n    path,\n    datetime(creation_utc\u002F1000000-11644473600, 'unixepoch') AS created,\n    datetime(expires_utc\u002F1000000-11644473600, 'unixepoch') AS expires,\n    datetime(last_access_utc\u002F1000000-11644473600, 'unixepoch') AS last_access,\n    is_secure,\n    is_httponly,\n    is_persistent\nFROM cookies\nORDER BY last_access_utc DESC;\nSQL\n\n# Extract Firefox cookies\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fcookies.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_cookies.csv\n\nSELECT\n    host,\n    name,\n    path,\n    datetime(creationTime\u002F1000000, 'unixepoch') AS created,\n    datetime(expiry, 'unixepoch') AS expires,\n    datetime(lastAccessed\u002F1000000, 'unixepoch') AS last_access,\n    isSecure,\n    isHttpOnly\nFROM moz_cookies\nORDER BY lastAccessed DESC;\nSQL\n\n# Note: Chrome Login Data is encrypted with DPAPI (Windows) or keychain (Mac)\n# Extract stored login URLs (passwords are encrypted)\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\"Login Data\" \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_logins.csv\n\nSELECT\n    origin_url,\n    action_url,\n    username_value,\n    datetime(date_created\u002F1000000-11644473600, 'unixepoch') AS date_created,\n    datetime(date_last_used\u002F1000000-11644473600, 'unixepoch') AS date_last_used,\n    times_used\nFROM logins\nORDER BY date_last_used DESC;\nSQL\n```\n\n### Step 5: Use Hindsight for Comprehensive Chrome Analysis\n\n```bash\n# Install Hindsight\npip install pyhindsight\n\n# Run Hindsight against Chrome profile\nhindsight -i \"\u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\" \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhindsight_report \\\n   -f xlsx\n\n# Hindsight automatically extracts:\n# - Browsing history with timestamps\n# - Downloads with source URLs\n# - Cookies with decryption (where possible)\n# - Cache records\n# - Local Storage entries\n# - Autofill data\n# - Saved passwords (encrypted)\n# - Preferences and extensions\n# - Session\u002Ftab recovery data\n\n# For JSONL output (easier to parse)\nhindsight -i \"\u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\" \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhindsight_report \\\n   -f jsonl\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Chrome timestamp | Microseconds since January 1, 1601 (WebKit\u002FChrome epoch) |\n| Firefox timestamp | Microseconds since January 1, 1970 (Unix epoch in microseconds) |\n| Transition types | How a URL was accessed: typed (1), link (0), bookmark (1), redirect (5\u002F6) |\n| DPAPI encryption | Windows Data Protection API encrypting stored passwords and cookies |\n| places.sqlite | Firefox combined history and bookmark database |\n| SQLite WAL | Write-Ahead Log that may contain recently deleted browser records |\n| Session restore | Browser data preserving open tabs across restarts |\n| IndexedDB | Browser-based database that may contain web application data |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Hindsight | Comprehensive Chrome\u002FChromium forensic analysis tool |\n| sqlite3 | Command-line SQLite database query tool |\n| DB Browser for SQLite | GUI tool for browsing SQLite databases |\n| BrowsingHistoryView | NirSoft tool for viewing browser history across all browsers |\n| ChromeCacheView | NirSoft tool for examining Chrome cache contents |\n| MZCacheView | NirSoft tool for Firefox cache analysis |\n| KAPE | Automated artifact collection including browser data |\n| Autopsy | Full forensic platform with browser artifact ingest modules |\n\n## Common Scenarios\n\n**Scenario 1: Phishing Investigation**\nExtract browser history around the reported phishing timeframe, identify the phishing URL that was visited, check downloads for malicious attachments, examine cookies for session tokens that may have been stolen, correlate with email header analysis.\n\n**Scenario 2: Data Exfiltration via Cloud Services**\nSearch history for cloud storage URLs (Dropbox, Google Drive, OneDrive, Mega), examine downloads and uploads, check form history for file names entered, review cookies for active cloud service sessions during the investigation period.\n\n**Scenario 3: Policy Violation Investigation**\nExtract complete browsing history for the investigation period, categorize sites visited, identify access to prohibited content categories, document timestamps and visit duration, correlate with network proxy logs for verification.\n\n**Scenario 4: Malware Delivery Vector Analysis**\nTrace the chain of redirects leading to a drive-by download, examine the downloads database for the malware payload, check cache for exploit kit landing pages, identify the initial referrer URL that started the infection chain.\n\n## Output Format\n\n```\nBrowser Forensics Summary:\n  User Profile: suspect (Windows 10)\n  Browsers Found: Chrome 120, Firefox 121, Edge 120\n\n  Chrome Analysis:\n    History Entries:    12,456\n    Downloads:          234\n    Saved Passwords:    67 sites (encrypted)\n    Cookies:            3,456\n    Bookmarks:          89\n\n  Firefox Analysis:\n    History Entries:    5,678\n    Form Entries:       234\n    Bookmarks:          45\n    Cookies:            1,234\n\n  Suspicious Findings:\n    - Visited known phishing URL at 2024-01-15 14:32 UTC\n    - Downloaded \"invoice_update.exe\" from suspicious domain\n    - Cloud storage (mega.nz) accessed 15 times in 2-hour window\n    - Search queries: \"how to encrypt files\", \"secure file transfer\"\n\n  Reports:\n    Chrome History:   \u002Fanalysis\u002Fchrome_history.csv\n    Firefox History:  \u002Fanalysis\u002Ffirefox_history.csv\n    Full Report:      \u002Fanalysis\u002Fhindsight_report.xlsx\n```\n","# Extracting Browser History Artifacts\n\n## When to Use\n- When investigating user web activity as part of a forensic examination\n- During insider threat investigations to establish patterns of data exfiltration\n- When tracing user visits to malicious or policy-violating websites\n- For correlating browser activity with other forensic artifacts and timelines\n- When investigating phishing attacks to identify which links were clicked\n\n## Prerequisites\n- Forensic image or access to user profile directories\n- SQLite3 for querying browser databases\n- Hindsight, BrowsingHistoryView, or DB Browser for SQLite\n- Knowledge of browser artifact file locations per OS\n- Python 3 with sqlite3 module for automated extraction\n- Understanding of Chrome, Firefox, and Edge storage formats\n\n## Workflow\n\n### Step 1: Locate Browser Artifact Files\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Chrome artifact locations (Windows)\nCHROME_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FLocal\u002FGoogle\u002FChrome\u002FUser Data\u002FDefault\"\n# Key files: History, Cookies, Login Data, Web Data, Bookmarks, Preferences,\n#            Cache\u002F, GPUCache\u002F, Local Storage\u002F, Session Storage\u002F, IndexedDB\u002F\n\n# Firefox artifact locations (Windows)\nFIREFOX_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FRoaming\u002FMozilla\u002FFirefox\u002FProfiles\u002F*.default-release\"\n# Key files: places.sqlite, cookies.sqlite, formhistory.sqlite, logins.json,\n#            key4.db, sessionstore.jsonlz4, webappsstore.sqlite\n\n# Edge (Chromium) artifact locations (Windows)\nEDGE_WIN=\"\u002Fmnt\u002Fevidence\u002FUsers\u002Fsuspect\u002FAppData\u002FLocal\u002FMicrosoft\u002FEdge\u002FUser Data\u002FDefault\"\n\n# Copy artifacts to working directory\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002F{chrome,firefox,edge}\ncp -r \"$CHROME_WIN\"\u002F{History,Cookies,Downloads,\"Login Data\",\"Web Data\",Bookmarks} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F 2>\u002Fdev\u002Fnull\ncp -r $FIREFOX_WIN\u002F{places.sqlite,cookies.sqlite,formhistory.sqlite,logins.json} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002F 2>\u002Fdev\u002Fnull\ncp -r \"$EDGE_WIN\"\u002F{History,Cookies,Downloads} \\\n   \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fedge\u002F 2>\u002Fdev\u002Fnull\n\n# Hash artifacts for integrity\nfind \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002F -type f -exec sha256sum {} \\; \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fartifact_hashes.txt\n```\n\n### Step 2: Extract Chrome Browsing History and Downloads\n\n```bash\n# Query Chrome History database\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_history.csv\n\nSELECT\n    urls.url,\n    urls.title,\n    datetime(urls.last_visit_time\u002F1000000-11644473600, 'unixepoch') AS last_visit,\n    urls.visit_count,\n    urls.typed_count,\n    visits.transition & 0xFF AS transition_type\nFROM urls\nLEFT JOIN visits ON urls.id = visits.url\nORDER BY urls.last_visit_time DESC;\nSQL\n\n# Extract Chrome downloads\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_downloads.csv\n\nSELECT\n    current_path,\n    tab_url AS source_url,\n    total_bytes,\n    datetime(start_time\u002F1000000-11644473600, 'unixepoch') AS start_time,\n    datetime(end_time\u002F1000000-11644473600, 'unixepoch') AS end_time,\n    state,\n    danger_type,\n    mime_type\nFROM downloads\nORDER BY start_time DESC;\nSQL\n\n# Extract Chrome search terms\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FHistory \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_searches.csv\n\nSELECT\n    term,\n    urls.url,\n    datetime(urls.last_visit_time\u002F1000000-11644473600, 'unixepoch') AS search_time\nFROM keyword_search_terms\nJOIN urls ON keyword_search_terms.url_id = urls.id\nORDER BY urls.last_visit_time DESC;\nSQL\n```\n\n### Step 3: Extract Firefox Browsing History\n\n```bash\n# Query Firefox places.sqlite for history\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fplaces.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_history.csv\n\nSELECT\n    moz_places.url,\n    moz_places.title,\n    datetime(moz_historyvisits.visit_date\u002F1000000, 'unixepoch') AS visit_date,\n    moz_places.visit_count,\n    moz_historyvisits.visit_type\nFROM moz_places\nJOIN moz_historyvisits ON moz_places.id = moz_historyvisits.place_id\nORDER BY moz_historyvisits.visit_date DESC;\nSQL\n\n# Extract Firefox bookmarks\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fplaces.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_bookmarks.csv\n\nSELECT\n    moz_bookmarks.title,\n    moz_places.url,\n    datetime(moz_bookmarks.dateAdded\u002F1000000, 'unixepoch') AS date_added,\n    datetime(moz_bookmarks.lastModified\u002F1000000, 'unixepoch') AS last_modified\nFROM moz_bookmarks\nJOIN moz_places ON moz_bookmarks.fk = moz_places.id\nWHERE moz_bookmarks.type = 1\nORDER BY moz_bookmarks.dateAdded DESC;\nSQL\n\n# Extract Firefox form history (search terms, form fills)\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fformhistory.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_forms.csv\n\nSELECT\n    fieldname,\n    value,\n    timesUsed,\n    datetime(firstUsed\u002F1000000, 'unixepoch') AS first_used,\n    datetime(lastUsed\u002F1000000, 'unixepoch') AS last_used\nFROM moz_formhistory\nORDER BY lastUsed DESC;\nSQL\n```\n\n### Step 4: Extract Cookies and Stored Credentials\n\n```bash\n# Extract Chrome cookies\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002FCookies \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_cookies.csv\n\nSELECT\n    host_key,\n    name,\n    path,\n    datetime(creation_utc\u002F1000000-11644473600, 'unixepoch') AS created,\n    datetime(expires_utc\u002F1000000-11644473600, 'unixepoch') AS expires,\n    datetime(last_access_utc\u002F1000000-11644473600, 'unixepoch') AS last_access,\n    is_secure,\n    is_httponly,\n    is_persistent\nFROM cookies\nORDER BY last_access_utc DESC;\nSQL\n\n# Extract Firefox cookies\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Ffirefox\u002Fcookies.sqlite \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffirefox_cookies.csv\n\nSELECT\n    host,\n    name,\n    path,\n    datetime(creationTime\u002F1000000, 'unixepoch') AS created,\n    datetime(expiry, 'unixepoch') AS expires,\n    datetime(lastAccessed\u002F1000000, 'unixepoch') AS last_access,\n    isSecure,\n    isHttpOnly\nFROM moz_cookies\nORDER BY lastAccessed DESC;\nSQL\n\n# Note: Chrome Login Data is encrypted with DPAPI (Windows) or keychain (Mac)\n# Extract stored login URLs (passwords are encrypted)\nsqlite3 \u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\"Login Data\" \u003C\u003C 'SQL'\n.headers on\n.mode csv\n.output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchrome_logins.csv\n\nSELECT\n    origin_url,\n    action_url,\n    username_value,\n    datetime(date_created\u002F1000000-11644473600, 'unixepoch') AS date_created,\n    datetime(date_last_used\u002F1000000-11644473600, 'unixepoch') AS date_last_used,\n    times_used\nFROM logins\nORDER BY date_last_used DESC;\nSQL\n```\n\n### Step 5: Use Hindsight for Comprehensive Chrome Analysis\n\n```bash\n# Install Hindsight\npip install pyhindsight\n\n# Run Hindsight against Chrome profile\nhindsight -i \"\u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\" \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhindsight_report \\\n   -f xlsx\n\n# Hindsight automatically extracts:\n# - Browsing history with timestamps\n# - Downloads with source URLs\n# - Cookies with decryption (where possible)\n# - Cache records\n# - Local Storage entries\n# - Autofill data\n# - Saved passwords (encrypted)\n# - Preferences and extensions\n# - Session\u002Ftab recovery data\n\n# For JSONL output (easier to parse)\nhindsight -i \"\u002Fcases\u002Fcase-2024-001\u002Fbrowser\u002Fchrome\u002F\" \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhindsight_report \\\n   -f jsonl\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Chrome timestamp | Microseconds since January 1, 1601 (WebKit\u002FChrome epoch) |\n| Firefox timestamp | Microseconds since January 1, 1970 (Unix epoch in microseconds) |\n| Transition types | How a URL was accessed: typed (1), link (0), bookmark (1), redirect (5\u002F6) |\n| DPAPI encryption | Windows Data Protection API encrypting stored passwords and cookies |\n| places.sqlite | Firefox combined history and bookmark database |\n| SQLite WAL | Write-Ahead Log that may contain recently deleted browser records |\n| Session restore | Browser data preserving open tabs across restarts |\n| IndexedDB | Browser-based database that may contain web application data |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Hindsight | Comprehensive Chrome\u002FChromium forensic analysis tool |\n| sqlite3 | Command-line SQLite database query tool |\n| DB Browser for SQLite | GUI tool for browsing SQLite databases |\n| BrowsingHistoryView | NirSoft tool for viewing browser history across all browsers |\n| ChromeCacheView | NirSoft tool for examining Chrome cache contents |\n| MZCacheView | NirSoft tool for Firefox cache analysis |\n| KAPE | Automated artifact collection including browser data |\n| Autopsy | Full forensic platform with browser artifact ingest modules |\n\n## Common Scenarios\n\n**Scenario 1: Phishing Investigation**\nExtract browser history around the reported phishing timeframe, identify the phishing URL that was visited, check downloads for malicious attachments, examine cookies for session tokens that may have been stolen, correlate with email header analysis.\n\n**Scenario 2: Data Exfiltration via Cloud Services**\nSearch history for cloud storage URLs (Dropbox, Google Drive, OneDrive, Mega), examine downloads and uploads, check form history for file names entered, review cookies for active cloud service sessions during the investigation period.\n\n**Scenario 3: Policy Violation Investigation**\nExtract complete browsing history for the investigation period, categorize sites visited, identify access to prohibited content categories, document timestamps and visit duration, correlate with network proxy logs for verification.\n\n**Scenario 4: Malware Delivery Vector Analysis**\nTrace the chain of redirects leading to a drive-by download, examine the downloads database for the malware payload, check cache for exploit kit landing pages, identify the initial referrer URL that started the infection chain.\n\n## Output Format\n\n```\nBrowser Forensics Summary:\n  User Profile: suspect (Windows 10)\n  Browsers Found: Chrome 120, Firefox 121, Edge 120\n\n  Chrome Analysis:\n    History Entries:    12,456\n    Downloads:          234\n    Saved Passwords:    67 sites (encrypted)\n    Cookies:            3,456\n    Bookmarks:          89\n\n  Firefox Analysis:\n    History Entries:    5,678\n    Form Entries:       234\n    Bookmarks:          45\n    Cookies:            1,234\n\n  Suspicious Findings:\n    - Visited known phishing URL at 2024-01-15 14:32 UTC\n    - Downloaded \"invoice_update.exe\" from suspicious domain\n    - Cloud storage (mega.nz) accessed 15 times in 2-hour window\n    - Search queries: \"how to encrypt files\", \"secure file transfer\"\n\n  Reports:\n    Chrome History:   \u002Fanalysis\u002Fchrome_history.csv\n    Firefox History:  \u002Fanalysis\u002Ffirefox_history.csv\n    Full Report:      \u002Fanalysis\u002Fhindsight_report.xlsx\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":32,"description":7,"mitre_attack":57},[27,50,41,40,37,29,28],"browser-forensics","mahipal","1.0",[54,55,56],"RS.AN-03","DE.AE-02","RS.MA-01",[58,59,60,61,62],"T1005","T1074","T1119","T1070","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fextracting-browser-history-artifacts",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-browser-history-artifacts",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-browser-history-artifacts",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-browser-history-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2171,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",7871,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-browser-history-artifacts\u002Fscripts\u002Fagent.py",[105,130,153,181,205,232],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,117,43,42,118,119,120,25,121,122,123,124,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,117,141,43,119,142,143,144,31,145,146,147,148,149,150,151,152],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":163,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[159,162],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,164,165,166,167,43,168,169,142,170,171,172,173,174,175,176,177,178,179,180],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,191,43,192,26,193,194,195,196,197,198,199,200,32,201,31,202,203,204],"windows","kape","triaging windows with kape","registry","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,43,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,240,43,241,242,243,244,245,246,247,248,176,249,177,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]