analyzing-browser-forensics-with-hindsight

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill analyzing-browser-forensics-with-hindsight

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

View all from this repository

Analyzing Browser Forensics with Hindsight

Overview

Hindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.

When to Use

When investigating security incidents that require analyzing browser forensics with hindsight

When building detection rules or threat hunting queries for this domain

When SOC analysts need structured procedures for this analysis type

When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

Most-missed artifacts: investigators stop at History and skip Sessions/, Current Tabs/Last Session (tabs open at shutdown), Network Action Predictor (typed URLs that never completed a visit), Media History, Top Sites, and the Local Storage/IndexedDB LevelDB stores where webmail and SaaS apps cache content. Hindsight parses these only if you point it at the full profile, not just Default\History.

Deleted history persists: rows removed from the urls/visits tables survive in the SQLite WAL (History-wal/-shm) and freelist pages. Run Hindsight with the -wal/-shm files present and carve freed pages before concluding "no activity."

Encrypted values are not empty: cookies.value and Login Data are DPAPI/AES-GCM encrypted - a blank field is not "no cookie." Decrypt with the profile's Local State key plus the DPAPI masterkey, otherwise report "present but encrypted."

Cross-corroborate every finding: confirm a visit against a second source - visits.visit_time vs the downloads table, vs $MFT/ for the downloaded file, vs Prefetch for the browser launch, vs proxy/DNS logs. Check the type before claiming the user manually navigated (autocomplete, redirects, and prerender all create visit rows).

Analyzing Browser Forensics with Hindsight

Overview

When to Use

When investigating security incidents that require analyzing browser forensics with hindsight

When building detection rules or threat hunting queries for this domain

When SOC analysts need structured procedures for this analysis type

When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

import sqlite3 import os import json import sys from datetime import datetime, timedelta CHROME_EPOCH = datetime(1601, 1, 1) def chrome_time_to_datetime(chrome_ts: int): """Convert Chrome timestamp to datetime.""" if chrome_ts == 0: return None try: return CHROME_EPOCH + timedelta(microseconds=chrome_ts) except (OverflowError, OSError): return None def analyze_chrome_history(profile_path: str, output_dir: str) -> dict: """Analyze Chrome History database for forensic evidence.""" history_db = os.path.join(profile_path, "History") if not os.path.exists(history_db): return {"error": "History database not found"} os.makedirs(output_dir, exist_ok=True) conn = sqlite3.connect(f"file:{history_db}?mode=ro", uri=True) # URL visits with timestamps cursor = conn.cursor() cursor.execute(""" SELECT u.url, u.title, v.visit_time, u.visit_count, v.transition & 0xFF as transition_type FROM visits v JOIN urls u ON v.url = u.id ORDER BY v.visit_time DESC LIMIT 5000 """) visits = [{ "url": r[0], "title": r[1], "visit_time": str(chrome_time_to_datetime(r[2])), "total_visits": r[3], "transition": r[4] } for r in cursor.fetchall()] # Downloads cursor.execute(""" SELECT target_path, tab_url, start_time, end_time, received_bytes, total_bytes, mime_type, state FROM downloads ORDER BY start_time DESC LIMIT 1000 """) downloads = [{ "path": r[0], "source_url": r[1], "start_time": str(chrome_time_to_datetime(r[2])), "end_time": str(chrome_time_to_datetime(r[3])), "received_bytes": r[4], "total_bytes": r[5], "mime_type": r[6], "state": r[7] } for r in cursor.fetchall()] # Keyword searches cursor.execute(""" SELECT k.term, u.url, k.url_id FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id ORDER BY u.last_visit_time DESC LIMIT 1000 """) searches = [{"term": r[0], "url": r[1]} for r in cursor.fetchall()] conn.close() report = { "analysis_timestamp": datetime.now().isoformat(), "profile_path": profile_path, "total_visits": len(visits), "total_downloads": len(downloads), "total_searches": len(searches), "visits": visits, "downloads": downloads, "searches": searches } report_path = os.path.join(output_dir, "browser_forensics.json") with open(report_path, "w") as f: json.dump(report, f, indent=2) return report def main(): if len(sys.argv) < 3: print("Usage: python process.py <chrome_profile_path> <output_dir>") sys.exit(1) analyze_chrome_history(sys.argv[1], sys.argv[2]) if __name__ == "__main__": main()

name	analyzing-browser-forensics-with-hindsight
description	Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
domain	cybersecurity
subdomain	digital-forensics
tags	["browser-forensics","hindsight","chrome-forensics","chromium","edge","browsing-history","cookies","downloads","cache","web-artifacts"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

name	analyzing-browser-forensics-with-hindsight
description	Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
domain	cybersecurity
subdomain	digital-forensics
tags	["browser-forensics","hindsight","chrome-forensics","chromium","edge","browsing-history","cookies","downloads","cache","web-artifacts"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Browser	Windows Profile Path
Chrome	%LOCALAPPDATA%\Google\Chrome\User Data\Default\
Edge	%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\
Brave	%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\
Opera	%APPDATA%\Opera Software\Opera Stable\
Vivaldi	%LOCALAPPDATA%\Vivaldi\User Data\Default\
Chrome (macOS)	~/Library/Application Support/Google/Chrome/Default/
Chrome (Linux)	~/.config/google-chrome/Default/

File	Contents
History	URL visits, downloads, keyword searches
Cookies	HTTP cookies with domain, expiry, values
Web Data	Autofill entries, saved credit cards
Login Data	Saved usernames/passwords (encrypted)
Bookmarks	JSON bookmark tree
Preferences	Browser configuration and extensions
Local Storage/	HTML5 Local Storage per domain
Session Storage/	Session-specific storage per domain
Network Action Predictor	Previously typed URLs
Shortcuts	Omnibox shortcuts and predictions
Top Sites	Frequently visited sites

analyzing-browser-forensics-with-hindsight

Install options

Review the source files