firefox dump working

2025-12-02 11:58:59 +01:00
parent c8fff22a64
commit f57850f243
15 changed files with 737 additions and 4 deletions
@@ -22,6 +22,7 @@ This document provides detailed explanations of Cazalla's key features and capab
 - [Keylogging Support](#keylogging-support)
 - [File Downloads Support](#file-downloads-support)
 - [File Uploads Support](#file-uploads-support)
+- [System Information Gathering](#system-information-gathering)
 - [OPSEC Checking](#opsec-checking)

 ---
@@ -405,6 +406,68 @@ Cazalla supports uploading files from the Mythic server to the target using chun

 ---

+## System Information Gathering
+
+Cazalla includes commands for gathering system information with low detection risk.
+
+### Features
+
+- **Browser Detection**: Identify installed web browsers and default browser
+- **Read-Only Operations**: No system modifications, minimal detection risk
+- **Version Information**: Extract version details from browser executables
+- **Registry Queries**: Query Windows registry for browser associations
+
+### Commands
+
+#### `browser_info`
+
+Identifies all installed web browsers on the target system and determines the default browser.
+
+**Supported Browsers:**
+- Google Chrome
+- Microsoft Edge
+- Mozilla Firefox
+- Opera
+- Brave
+
+**Output Includes:**
+- Installation paths for each detected browser
+- Version information (when available)
+- Default browser identification
+
+**OPSEC Considerations:**
+- Low detection risk - read-only operations
+- Registry reads may be logged if auditing enabled
+- No process creation or network activity
+- No file modifications
+
+**Example:**
+```
+browser_info
+```
+
+**Output:**
+```
+=== Installed Browsers ===
+
+[1] Microsoft Edge
+    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+    Version: 142.0.3595.94
+
+[2] Mozilla Firefox
+    Path: C:\Program Files\Mozilla Firefox\firefox.exe
+    Version: 145.0.1.627
+
+=== Default Browser ===
+
+Name: Microsoft Edge
+Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
+```
+
+For detailed information, see [browser_info command documentation](commands/browser_info.md).
+
+---
+
 ## OPSEC Checking

 Cazalla includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks.
@@ -424,7 +487,7 @@ Cazalla includes comprehensive OPSEC Checking functionality that provides operat
 ### Commands with OPSEC Checking

 - **High-Risk Commands (Blocking)**: `shell`, `steal_token`, `kill`, `keylog_start`, `rm` (system files)
- **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, etc.
+- **Warning-Only Commands**: `screenshot`, `rpfwd`, `socks`, `download`, `upload`, `make_token`, `browser_info`, etc.

 ### Bypass Roles