# browser_info - Identify Installed Browsers

Identify installed web browsers and the default browser on the target system.

## Description

The `browser_info` command identifies all installed web browsers on the target system and determines the default browser. It checks for common browsers including Chrome, Edge, Firefox, Opera, and Brave, displaying their installation paths and version information.

## Syntax

```
browser_info
```

## Parameters

This command does not accept any parameters.

## Examples

```
browser_info
```

## Features

- Detects multiple browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave
- Displays installation paths for each detected browser
- Shows version information when available
- Identifies the system's default browser
- Read-only operation - does not modify system state
- Low detection risk - only reads registry and file system

## Output

```
=== Installed Browsers ===

[1] Google Chrome
    Path: C:\Program Files\Google\Chrome\Application\chrome.exe
    Version: 120.0.6099.109.0

[2] Microsoft Edge
    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    Version: 120.0.2210.91.0

[3] Mozilla Firefox
    Path: C:\Program Files\Mozilla Firefox\firefox.exe
    Version: 121.0.0.0

=== Default Browser ===

Name: Google Chrome
Path: C:\Program Files\Google\Chrome\Application\chrome.exe
```

## Detection Methods

The command uses the following methods to identify browsers:

1. **File System Checks**: Checks common installation paths for browser executables
2. **Registry Queries**: Reads registry keys to determine default browser associations
3. **Version Information**: Extracts version data from executable files when available

### Registry Keys Accessed

- `HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice`
- `HKEY_CLASSES_ROOT\http\shell\open\command`

## OPSEC Considerations

- **Low Detection Risk**: Read-only operations are rarely flagged by security tools
- **Registry Reads**: May be logged if registry auditing is enabled
- **File System Access**: File existence checks may be logged if file auditing is enabled
- **No Process Creation**: Does not spawn any processes
- **No Network Activity**: Does not create network connections
- **No File Modifications**: Does not modify any files or registry keys

## Artifacts

The command automatically reports the following artifacts:

- **Registry Read**: Browser registry keys accessed
- **File Read**: Browser installation paths checked

## Related

[System Information Gathering](../../../features.md#system-information-gathering)

---

**Command Category:** System Operations  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1082 - System Information Discovery](https://attack.mitre.org/techniques/T1082/), [T1518 - Software Discovery](https://attack.mitre.org/techniques/T1518/)