jilotune.blogg.se - Thunderbird open sqlite file

#Thunderbird open sqlite file windows#

key4.db – NSS key database used to store Mozilla encryption data.cookies.sqlite – Stores user’s browser cookies.places.sqlite – Stores user’s browser history.

global-messages-db.sqlite – An index of all a user’s messages created by Thunderbird.

They both use numerous files to store data, but the juicy stuff can all be found here: # Thunderbird C:\Users\USER\AppData\Roaming\Thunderbird\Profiles\ # Firefox C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\ Mozilla filesīy default, you’ll find Thunderbird and Firefox user profiles located here: I figured I’d take a look at finding a convenient way to retrieve useful data from both of these products directly from a target system without having to exfiltrate the numerous SQLite databases they use for storage. Still, sifting through these DBs can be pretty annoying once you’ve extracted them since you’ll either have to import them into a Thunderbird/Firefox installation on a system you control or manually execute SQL queries on the files using DB browser or a similar program. Google Chrome, these databases aren-t encrypted and can easily be read once they’ve been exfiltrated from a target system.

#Thunderbird open sqlite file windows#

Like many Windows applications, they both use SQLite databases to store their information – and unlike other “similar” products e.g. Reading data from Mozilla apps such as Thunderbird and Firefox has never been much of a challenge during engagements. Extracting sensitive information from Mozilla apps.