- You can instantly recover all these sign-on passwords using tools such as FirePassword (command line) or FirePasswordViewer (GUI).
- Firefox provides additional protection option called ‘master password’ to prevent malicious users from discovering these sign-on passwords. Master password as such is not stored any where directly but it’s one way hash and other relevant information is stored in the key3.db file within the profile directory.
- In case you have lost your master password, then you can recover it using FireMaster tool.
FirePasswordViewer Tutorial
1. About FirePasswordViewer
FirePasswordViewer is the GUI version of popular FirePassword tool to recover login passwords stored by Firefox. Like other browsers, Firefox also stores the login details such as username, password for every website visited by the user at the user consent. All these secret details are stored in Firefox sign-on database securely in an encrypted format.
Also FirePasswordViewer can be used to recover sign-on passwords from different profile (for other users on the same system) as well as from the different operating system (such as Linux, Mac etc). This greatly helps forensic investigators who can copy the Firefox profile data from the target system to different machine and recover the passwords offline without affecting the target environment.
FirePasswordViewer is fully portable tool which works on wider range of platforms starting from Windows XP to latest operating system, Windows 7.
2. Features of FirePasswordViewer
- Instantly decrypt and recover stored encrypted passwords from ‘Firefox Sign-on Secret Store’ for all versions of Firefox.
- Supports recovery of passwords from local system as well as remote system. User can specify Firefox profile location from the remote system to recover the passwords.
- It can recover passwords from Firefox secret store even when it is protected with master password. In such case user have to enter the correct master password to successfully decrypt the sign-on passwords.
- Sort feature to arrange the displayed password list by username, password or website which makes it easy to search through 100’s of entries.
- Save the recovered Firefox password list to HTML file for transferring to other system or for future use.
About Firefox Password Manager
- Firefox has a built-in password manager tool which stores username and passwords for all the visited websites. These credentials are stored in the encrypted form in the Firefox profile’s database files such as key3.db and signons.txt.
- The key3.db file contains master password related information such as encrypted password check string, salt, algorithm and version information etc.
- Signons.txt file contains the actual sign-on information à
Reject Host list : List of websites for which user don’t want Firefox to remember the credentials.
Normal Host List : Each host URL is followed by username and password.
About Firefox Password Manager
- You can instantly recover all these sign-on passwords using tools such as FirePassword (command line) or FirePasswordViewer (GUI).
- Firefox provides additional protection option called ‘master password’ to prevent malicious users from discovering these sign-on passwords. Master password as such is not stored any where directly but it’s one way hash and other relevant information is stored in the key3.db file within the profile directory.
- In case you have lost your master password, then you can recover it using FireMaster tool.
Using FirePasswordViewer
- FirePasswordViewer is the standalone application and it does not require any installation. You can just run it by double clicking on the executable file.
Here are the brief usage details.
- On running, FirePasswordViewer automatically populates the Firefox profile location if it is already installed. Otherwise you can enter the profile location manually.
- If you have set the master password for your Firefox, then you need to specify the same in the master password box.
- Once the profile location is specified, you can click on ‘Start Recovery’ button and FirePasswordViewer will instantly recover all passwords from Firefox sign-on store.
- By default passwords are not shown for security reasons as it is sensitive data. However you can click on ‘Show Password’ button to view these passwords.
- Finally you can save all recovered password list to HTML file by clicking on ‘Save as HTML’ button.
You can also use FirePasswordViewer to recover passwords from different system either Windows or Linux. In that case you can copy Firefox profile data from remote system to local machine and then specify that path in the profile location field for recovering the passwords.
FireMaster Tutorial
About FireMaster
- FireMaster is the first ever built tool to recover the lost master password of Firefox. Master password is used by Firefox to protect the stored sign-on information for all visited websites. If the master password is forgotten, then there is no way to recover the master password and user will lose all the sign-on information stored in it.
- However user can now use FireMaster to get back all their stored credentials. FireMaster uses combination of techniques such as dictionary, hybrid and brute force to recover the master password from the Firefox key database file.
- Now it also supports pattern based password recovery mechanism which significantly reduces the time taken to recover the password.
Current version comes with ‘Setup Wizard’ for Installation & Un-installation of FireMaster on your local system.
Firefox Password Manager and Master Password
- Firefox comes with built-in password manager tool which remembers username and passwords for all the websites you visit. This sign-on information is stored in the encrypted form in Firefox database files residing in user’s profile directory.
- However any body can just launch the password manager from the Firefox browser and view the credentials. Also one can just copy these database files to different machine and view it offline using the tools such as FirePassword.
- Hence to protect from such threats, Firefox uses master password to provide enhanced security. By default Firefox does not set the master password. However once you have set the master password, you need to provide it every time to view sign-on credentials. So if you have lost the master password, then you have lost all the stored credentials as well.
Internals of FireMaster
Once you have lost master password, there is no way to recover it as it is not stored at all. Whenever user enters the master password, Firefox uses it to decrypt the encrypted data associated with the known string.
If the decrypted data matches this known string then the entered password is correct. FireMaster uses the similar technique to check for the master password, but in more optimized way. The entire operation goes like this.
- FireMaster generates passwords on the fly through various methods.
- Then it computes the hash of the password using known algorithm.
- Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
- Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.
Firefox stores the details about encrypted string, salt, algorithm and version information in key database file key3.db in the user’s profile directory. You can just copy this key3.db file to different directory and specify the corresponding path to FireMaster. You can also copy this key3.db to any other high end machine for faster recovery operation.
FireMaster supports following password generation methods –>
1) Dictionary Method
In this mode, FireMaster uses dictionary file having each word on separate line to perform the operation. You can find lot of online dictionary with different sizes and pass it on to Firemaster. This method is more quicker and can find out common passwords.
2) Hybrid Method
This is advanced dictionary method, in which each word in the dictionary file is prefixed or suffixed with generated word from known character list. This can find out password like pass123, 12test, test34 etc. From the specified character list (such as 123), all combinations of strings are generated and appended or prefixed to the dictionary word based on user settings.
3) Brute Force Method
In this method, all possible combinations of words from given character list is generated and then subjected to cracking process. This may take long time depending upon the number of characters and position count specified.
How to use FireMaster ?
First you need to copy the key3.db file to temporary directory. Later you have to specify this directory path for FireMaster as a last argument.
Here is the general usage information
Firemaster [-q]
[-d -f <dict_file>]
[-h -f <dict_file> -n <length> -g “charlist” [ -s | -p ] ]
[-b -m <length> -l <length> -c “charlist” -p “pattern” ]
<Firefox_Profile_Path>
Dictionary Crack Options:
-d Perform dictionary crack
-f Dictionary file with words on each line
Hybrid Crack Options:
-h Perform hybrid crack operation using dictionary passwords.
Hybrid crack can find passwords like pass123, 123pass etc
-f Dictionary file with words on each line
-g Group of characters used for generating the strings
-n Maximum length of strings to be generated using above character list
These strings are added to the dictionary word to form the password
-s Suffix the generated characters to the dictionary word(pass123)
-p Prefix the generated characters to the dictionary word(123pass)
Brute Force Crack Options:
-b Perform brute force crack
-c Character list used for brute force cracking process
-m [Optional] Specify the minimum length of password
-l Specify the maximum length of password
-p [Optional] Specify the pattern for the password
Sample Usage Information
// Dictionary Crack
FireMaster.exe -d -f c:\dictfile.txt Firefox_Profile_Path
// Hybrid Crack
FireMaster.exe -h -f c:\dictfile.txt -n 3 -g “123” -s Firefox_Profile_Path
// Brute Force Crack
FireMaster.exe -q -b -m 3 -c “abyz126” -l 10 -p “pa??f??123” Firefox_Profile_Path
Here Firefox_Profile_Path refers to the directory where key3.db file is present. This points to the Firefox profile directory (Ex: C:\Documents and Settings\<user>\Application Data\Mozilla\Firefox\Profiles\<prof name>) on your machine.
However you can also copy key3.db file from any other machine such as Linux system to your local windows machine and specify that path during recovering operation.
Quiet mode ( -q option ) will disable printing each password while recovery is in progress. This makes it much faster especially for brute force operation. However during brute force operation if the password count exceeds 50000 passwords then it automatically enters the quiet mode.
Hybrid method tries normal dictionary password as well as password created by appending/prefixing the generated strings to the dictionary word. For example if the dictionary word is “test” and you have specified character set as ‘123’ (-c 123 -s) then the new passwords will be test1, test12, test123, test32 etc.
Character list (-g for hybrid and -c for brute force) specifies the characters to be used for generating passwords. If you don’t specify then the default character list is used. For brute force -m indicates the minimum length of password to be generated.
This can reduce the generated passwords and hence the time considerably when large number of character set is specified. Similarly -l (small ‘L’) specifies the maximum length of password to be generated. For example, if you specify -m 6 and -l 8 then only passwords which are of length at least 6 and above but below 8 will be generated.
Now you can reduce the password cracking time significantly using pattern based password recovery mechanism. If you know that password is of certain length and also remember few characters then you can specify that pattern for brute force cracking. For example, assume that you have set the master password of length 12 and it begins with ‘fire’ and ends with ‘123’ then command will look like below
FireMaster.exe -b -c “abyz” -l 12 -p “fire?????123” c:\testpath
This will reduce the time to seconds which otherwise would have taken days or hours to crack that password. You can even crack the impossible looking passwords using the right pattern.
Infinity Breaks's 