browser_info - Identify Installed Browsers

Identify installed web browsers and the default browser on the target system.

Description

The browser_info command identifies all installed web browsers on the target system and determines the default browser. It checks for common browsers including Chrome, Edge, Firefox, Opera, and Brave, displaying their installation paths and version information.

Syntax

browser_info

Parameters

This command does not accept any parameters.

Examples

browser_info

Features

Detects multiple browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave
Displays installation paths for each detected browser
Shows version information when available
Identifies the system's default browser
Read-only operation - does not modify system state
Low detection risk - only reads registry and file system

Output

=== Installed Browsers ===

[1] Google Chrome
    Path: C:\Program Files\Google\Chrome\Application\chrome.exe
    Version: 120.0.6099.109.0

[2] Microsoft Edge
    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    Version: 120.0.2210.91.0

[3] Mozilla Firefox
    Path: C:\Program Files\Mozilla Firefox\firefox.exe
    Version: 121.0.0.0

=== Default Browser ===

Name: Google Chrome
Path: C:\Program Files\Google\Chrome\Application\chrome.exe

Detection Methods

The command uses the following methods to identify browsers:

File System Checks: Checks common installation paths for browser executables
Registry Queries: Reads registry keys to determine default browser associations
Version Information: Extracts version data from executable files when available

Registry Keys Accessed

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice
HKEY_CLASSES_ROOT\http\shell\open\command

OPSEC Considerations

Low Detection Risk: Read-only operations are rarely flagged by security tools
Registry Reads: May be logged if registry auditing is enabled
File System Access: File existence checks may be logged if file auditing is enabled
No Process Creation: Does not spawn any processes
No Network Activity: Does not create network connections
No File Modifications: Does not modify any files or registry keys

Artifacts

The command automatically reports the following artifacts:

Registry Read: Browser registry keys accessed
File Read: Browser installation paths checked

System Information Gathering

Command Category: System Operations
Requires Admin: No
MITRE ATT&CK: T1082 - System Information Discovery, T1518 - Software Discovery

2.8 KiB Raw Blame History