busindre/mozcacheMozilla 브라우저(Firefox, Iceweasel, Seamonkey) 캐시에 대한 법의학 분석을 수행하는 간단한 셸 스크립트.
Mozilla 브라우저(Firefox, Iceweasel, Seamonkey) 캐시의 포렌식 분석을 수행하는 간단한 셸 스크립트입니다.
이 스크립트는 캐시 버전 2를 사용하는 Mozilla 계열 브라우저의 캐시된 파일을 날짜별로 정렬합니다. 각 파일의 이름과 함께 '_metadata' 접미사가 붙은 다른 파일을 생성하여 모든 메타데이터 정보(다운로드 URL, 크기, 서버 응답 코드, HTTP 프로토콜, 만료 날짜 등)를 저장합니다.
스크립트를 실행하고 캐시 디렉토리를 입력합니다. 사용자가 표준 경로에 프로필을 가지고 있으면 해당 경로가 표시됩니다.
$ bash mozcache.sh
Mozilla profiles cache directories found:
2014-08-15 00:47:02.403005545 +0200 /home/user/.cache/mozilla/firefox/4wg8s8jh.default
2018-01-17 19:06:36.788369163 +0100 /home/user/.cache/mozilla/firefox/5cp0rnwg.default
2018-01-17 19:02:44.585044984 +0100 /home/user/.cache/mozilla/firefox/87plgdtd.default
2014-07-05 00:35:11.338496398 +0200 /home/user/.cache/mozilla/firefox/8jj26wgs.default
2018-03-29 02:43:35.700103218 +0200 /home/user/.cache/mozilla/firefox/8wkejxi8.default
2016-02-15 21:55:10.512948007 +0100 /home/user/.cache/mozilla/firefox/czgxbzqe.default
2014-08-14 22:34:37.017763346 +0200 /home/user/.cache/mozilla/firefox/dq3l8pqo.default
2017-06-22 22:15:33.655428291 +0200 /home/user/.cache/mozilla/firefox/enmhte3j.default
2014-07-05 01:53:27.840783875 +0200 /home/user/.cache/mozilla/firefox/fu4s3k7b.default
2014-07-03 21:18:27.438401953 +0200 /home/user/.cache/mozilla/firefox/hs7mylo1.default
2014-07-05 00:38:20.964444484 +0200 /home/user/.cache/mozilla/firefox/i21pueej.default
2016-04-10 17:20:30.987988747 +0200 /home/user/.cache/mozilla/firefox/n78aixv9.default
2014-08-14 22:33:40.041315007 +0200 /home/user/.cache/mozilla/firefox/uha6gavb.default
2016-04-10 17:30:20.899882264 +0200 /home/user/.cache/mozilla/firefox/wnms415y.default
2016-04-10 18:00:19.575033506 +0200 /home/user/.cache/mozilla/firefox/x7uvgkeb.default
2016-10-22 17:04:57.889181389 +0200 /home/user/.cache/mozilla/firefox/z5thphqz.default
2018-03-27 21:31:53.793677603 +0200 /home/user/.cache/mozilla/seamonkey/1j0mk6zq.default
2016-03-02 19:17:19.762833514 +0100 /home/user/.cache/mozilla/seamonkey/zwuryy49.default
Cache directory path to analyze: /home/user/.cache/mozilla/seamonkey/zwuryy49.default
Output directory path (/home/user/mozcache): /home/user/mozcache_zwuryy49.default
$ ls /home/user/mozcache_zwuryy49.default
17-01-2018
22-03-2018
23-03-2018
24-03-2018
25-03-2018
26-03-2018
27-03-2018
28-03-2018
29-03-2018
캐시 콘텐츠를 분석합니다. 압축 파일 예시.
## Content and Metadata
$ file /home/user/mozcache_zwuryy49.default/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1
mozcache/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1: gzip compressed data, from Unix
$ zcat /home/user/mozcache_zwuryy49.default/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1
{"action-list":"https://normandy.cdn.mozilla.net/api/v1/action/","action-signed":"https://normandy.cdn.mozilla.net/api/v1/action/signed/","approvalrequest-list":"https://normandy.cdn.mozilla.net/api/v1/approval_request/","classify-client":"https://normandy.cdn.mozilla.net/api/v1/classify_client/","filters":"https://normandy.cdn.mozilla.net/api/v1/filters/","recipe-list":"https://normandy.cdn.mozilla.net/api/v1/recipe/","recipe-signed":"https://normandy.cdn.mozilla.net/api/v1/recipe/signed/","reciperevision-list":"https://normandy.cdn.mozilla.net/api/v1/recipe_revision/"}
gzip: mozcache/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1: decompression OK, trailing garbage ignored
## Metadata.
$ cat /home/user/mozcache_zwuryy49.default/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1_metadata
a,:https://normandy.cdn.mozilla.net/api/v1/
necko:classified
strongly-framed
security-info
FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAQAAgAAAAAAAAAAAAAAAAAAAAAB4vFIJp5wRkeyPxAQ9RJGKPqbqVvKO0mKuIl8e
request-method
request-Accept
application/json
response-head
HTTP/1.1 200 OK
Allow: GET, HEAD, OPTIONS
Cache-Control: public, max-age=30
Content-Encoding: gzip
Content-Security-Policy: base-uri 'none'; default-src 'self' https://normandy-cloudfront.cdn.mozilla.net/; block-all-mixed-content; worker-src 'none'; form-action 'self'; object-src 'none'; frame-src 'none'; report-uri /__cspreport__
Content-Type: application/json
Date: Wed, 17 Jan 2018 18:05:33 GMT
Public-Key-Pins: max-age=86400; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="sRHdihwgkaib1P1gxX8HFszlD+7/gTfNvuAybgLPNis=";
strict-transport-security: max-age=31536000; includeSubDomains
Vary: Accept
X-Cached: HIT
x-content-type-options: nosniff
X-Frame-Options: DENY
x-xss-protection: 1; mode=block
Content-Length: 173
original-response-headers
Allow: GET, HEAD, OPTIONS
Cache-Control: public, max-age=30
Content-Encoding: gzip
Content-Security-Policy: base-uri 'none'; default-src 'self' https://normandy-cloudfront.cdn.mozilla.net/; block-all-mixed-content; worker-src 'none'; form-action 'self'; object-src 'none'; frame-src 'none'; report-uri /__cspreport__
Content-Type: application/json
Date: Wed, 17 Jan 2018 18:05:33 GMT
Public-Key-Pins: max-age=86400; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="sRHdihwgkaib1P1gxX8HFszlD+7/gTfNvuAybgLPNis=";
strict-transport-security: max-age=31536000; includeSubDomains
Vary: Accept
X-Cached: HIT
x-content-type-options: nosniff
X-Frame-Options: DENY
x-xss-protection: 1; mode=block
Content-Length: 173
Connection: keep-alive
net-response-time-onstart
net-response-time-onstop
$ head -n1 /home/user/mozcache_zwuryy49.default/17-01-2018/63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1_metadata
a,:https://normandy.cdn.mozilla.net/api/v1/
$ echo -n "a,:https://normandy.cdn.mozilla.net/api/v1/" | sha1sum
63f48f4f7f1bc3195f5ab831f9794f3dba2d30e1 -