Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Notes on Browser-Based Credential Stealing
This page is for recording notes associated with harvesting creds from different browsers.
Browsers
Internet Explorer
Current research indicates that IEInternet Explorer has a few different categories for stored information (creds & data). These are AutoComplete (forms), Password Protected site (a page that utilizes say, Basic Auth or Digest Auth for access), and FTPFile Transfer Protocol creds (5),(6).
Storage locations are said to vary based on the version of IEInternet Explorer and the category of stored information.
Autocomplete can be disabled within the html of a specific page by a page author, via use of the "autocomplete" property(7),(8) on certain elements (e.g., an "input" element).
Chrome
Firefox
References
(1) Law, E., Why Won't IEInternet Explorer Remember My Login Info?, MSDNMicrosoft Developer Network Blogs, IEInternals, 10-Sep-2009, Last Accessed 3-Aug-2015
(2) Law, E., Forcing Internet Explorer To Forget to Not Remember, MSDNMicrosoft Developer Network Blogs, IEInternals, 08-Apr-2010, Last Accessed 3-Aug-2015
(3) Diaz, William, Exploring IE's Form Data, Windows Explored, 22-Dec-2011, Last Accessed 3-Aug-2015
(4) "Where does Internet Explorer Stores its form data history that it uses for auto completion?", Stack Overflow, 1276700, 14-Aug-2009, Last Accessed 3-Aug-2015
(5) IEInternet Explorer PassView Utility, nirsoft.net, Last Accessed 3-Aug-2015
(6) Protected Storage PassView, nirsoft.net, Last Accessed 3-Aug-2015
(7) Using AutoComplete in HTMLHypertext Markup Language Forms, msdn.microsoft.com/en-us/library/ms533032(v=vs.85).aspx, Last Accessed 3-Aug-2015
(8) autocomplete attribute|autocomplete property, msdn.microsoft.com/en-us/library/ms533486(v=vs.85).aspx, Last Accessed 3-Aug-2015