firefox dump working

2025-12-02 11:58:59 +01:00
parent c8fff22a64
commit f57850f243
15 changed files with 737 additions and 4 deletions
@@ -35,9 +35,12 @@ Complete documentation for all Cazalla agent commands, organized by category.
 ## System Operations

 - [`shell`](shell.md) - Execute shell commands
+- [`browser_info`](browser_info.md) - Identify installed browsers
+- [`browser_dump`](browser_dump.md) - Dump browser credentials
 - [`screenshot`](screenshot.md) - Capture desktop screenshot
 - [`keylog_start`](keylog_start.md) - Start keylogger
 - [`keylog_stop`](keylog_stop.md) - Stop keylogger
+- [`browser_info`](browser_info.md) - Identify installed browsers

 ## Control Commands

@@ -0,0 +1,95 @@
+# browser_info - Identify Installed Browsers
+
+Identify installed web browsers and the default browser on the target system.
+
+## Description
+
+The `browser_info` command identifies all installed web browsers on the target system and determines the default browser. It checks for common browsers including Chrome, Edge, Firefox, Opera, and Brave, displaying their installation paths and version information.
+
+## Syntax
+
+```
+browser_info
+```
+
+## Parameters
+
+This command does not accept any parameters.
+
+## Examples
+
+```
+browser_info
+```
+
+## Features
+
+- Detects multiple browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave
+- Displays installation paths for each detected browser
+- Shows version information when available
+- Identifies the system's default browser
+- Read-only operation - does not modify system state
+- Low detection risk - only reads registry and file system
+
+## Output
+
+```
+=== Installed Browsers ===
+
+[1] Google Chrome
+    Path: C:\Program Files\Google\Chrome\Application\chrome.exe
+    Version: 120.0.6099.109.0
+
+[2] Microsoft Edge
+    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+    Version: 120.0.2210.91.0
+
+[3] Mozilla Firefox
+    Path: C:\Program Files\Mozilla Firefox\firefox.exe
+    Version: 121.0.0.0
+
+=== Default Browser ===
+
+Name: Google Chrome
+Path: C:\Program Files\Google\Chrome\Application\chrome.exe
+```
+
+## Detection Methods
+
+The command uses the following methods to identify browsers:
+
+1. **File System Checks**: Checks common installation paths for browser executables
+2. **Registry Queries**: Reads registry keys to determine default browser associations
+3. **Version Information**: Extracts version data from executable files when available
+
+### Registry Keys Accessed
+
+- `HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice`
+- `HKEY_CLASSES_ROOT\http\shell\open\command`
+
+## OPSEC Considerations
+
+- **Low Detection Risk**: Read-only operations are rarely flagged by security tools
+- **Registry Reads**: May be logged if registry auditing is enabled
+- **File System Access**: File existence checks may be logged if file auditing is enabled
+- **No Process Creation**: Does not spawn any processes
+- **No Network Activity**: Does not create network connections
+- **No File Modifications**: Does not modify any files or registry keys
+
+## Artifacts
+
+The command automatically reports the following artifacts:
+
+- **Registry Read**: Browser registry keys accessed
+- **File Read**: Browser installation paths checked
+
+## Related
+
+[System Information Gathering](../../../features.md#system-information-gathering)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1082 - System Information Discovery](https://attack.mitre.org/techniques/T1082/), [T1518 - Software Discovery](https://attack.mitre.org/techniques/T1518/)
+