Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Notes on Browser-Based Credential Stealing
This page is for recording notes associated with harvesting creds from different browsers. The contents of this page are to be migrated into the larger wiki once a suitable place in the wiki hierarchy has been identified and "enough" information is present on this page.
Browsers
Internet Explorer
Current research indicates that IEInternet Explorer has a few different categories for stored information (creds & data). These are AutoComplete (forms), Password Protected site (a page that utilizes say, Basic Auth or Digest Auth for access), and FTPFile Transfer Protocol creds (5),(6).
Storage locations are said to vary based on the version of IE, the underlying OSOperating System (e.g., Windows 8), and the category of stored information.
Autocomplete can be disabled within the html of a specific page by a page author, via use of the "autocomplete" property(7),(8) on certain elements (e.g., an "input" element).
IE4-6
TBPosted. Until more info is posted in this section, please look at some of the references such as (5), (6), and (10).
IE7-9
Experimental evidence (checked with IE8, on Win7 x86) corroborates with written sources(3), (4), (5), (6), (10), (11) that IEInternet Explorer will store AutoComplete form data in a couple different registry keys, depending upon the nature of the form data.
The first key:
HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage1is used to store non-password form data (e.g., an "input" html element whose 'type' attribute is NOT 'password').
The second key:
HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2is used when there is 'password' data to store AND Internet Explorer recognizes the form as a "login"/password type of form(1). IEInternet Explorer can apparently be rather picky about remembering form and especially credential data(1).
IE10+
TBPosted. Until more info is posted here, please feel free to browse some of the listed references such as (6) and (10)
Chrome
Firefox
References
(1) Law, E., Why Won't IEInternet Explorer Remember My Login Info?, MSDNMicrosoft Developer Network Blogs, IEInternals, 10-Sep-2009, Last Accessed 3-Aug-2015
(2) Law, E., Forcing Internet Explorer To Forget to Not Remember, MSDNMicrosoft Developer Network Blogs, IEInternals, 08-Apr-2010, Last Accessed 3-Aug-2015
(3) Diaz, William, Exploring IE's Form Data, Windows Explored, 22-Dec-2011, Last Accessed 3-Aug-2015
(4) "Where does Internet Explorer Stores its form data history that it uses for auto completion?", Stack Overflow, 1276700, 14-Aug-2009, Last Accessed 3-Aug-2015
(5) IEInternet Explorer PassView Utility, nirsoft.net, Last Accessed 3-Aug-2015
(6) Protected Storage PassView, nirsoft.net, Last Accessed 3-Aug-2015
(7) Using AutoComplete in HTMLHypertext Markup Language Forms, msdn.microsoft.com/en-us/library/ms533032(v=vs.85).aspx, Last Accessed 3-Aug-2015
(8) autocomplete attribute|autocomplete property, msdn.microsoft.com/en-us/library/ms533486(v=vs.85).aspx, Last Accessed 3-Aug-2015
(9) "DPAPI Secrets, Security analysis and data recovery in DPAPI", passcape.com, Last Accessed 3-Aug-2015
(10) "Exposing the Password Secrets of Internet Explorer", securityxploaded.com/iepasswordsecrets.php ,Last Accessed 4-Aug-2015
(11) "How Browsers Store Your Passwords (and Why You Shouldn't Let Them), RaiderSec Blog, raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html ,Last Accessed 4-Aug-2015
(12) SapporoWorks, "The certification password of Internet Explorer 7 and operation of auto complete", 25 Jan 2007, securityfocus.com/archive/1/458115/30/0/threaded ,Last Accessed 5-Aug-2015