├── .gitignore ├── extension_finder ├── __init__.py ├── Browsers │ ├── __init__.py │ ├── Extension.py │ ├── Browser.py │ ├── InternetExplorer.py │ └── Chrome.py ├── Finder.py └── Constants.py ├── requirements.txt ├── extension_finder.py ├── FindIEExtensions.ps1 └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | *.pyc 2 | -------------------------------------------------------------------------------- /extension_finder/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /extension_finder/Browsers/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | enum==0.4.6 2 | tabulate==0.7.5 -------------------------------------------------------------------------------- /extension_finder.py: -------------------------------------------------------------------------------- 1 | """ 2 | extension_finder.py - 3 | @brad_anton 4 | 5 | Simple Script to identify which browser extensions are installed on a system. 6 | 7 | """ 8 | from extension_finder.Finder import Finder 9 | 10 | if __name__ == '__main__': 11 | f = Finder() 12 | f.print_extensions() 13 | 14 | -------------------------------------------------------------------------------- /extension_finder/Browsers/Extension.py: -------------------------------------------------------------------------------- 1 | """ 2 | Extension.py - Just to standardize the extension information 3 | @brad_anton 4 | 5 | """ 6 | 7 | class Extension: 8 | def __init__(self, name, version, path, id): 9 | self.name = name 10 | self.version = version 11 | self.path = path 12 | 13 | """Just about every browser creates some sort 14 | of unique identifier for the extension 15 | """ 16 | self.id = id 17 | 18 | def todict(self): 19 | result = {} 20 | for key in self.__dict__: 21 | if self.__dict__[key]: result[key] = self.__dict__[key] 22 | return result 23 | 24 | -------------------------------------------------------------------------------- /extension_finder/Browsers/Browser.py: -------------------------------------------------------------------------------- 1 | """ 2 | Browser.py - 3 | @brad_anton 4 | 5 | """ 6 | 7 | from os import path 8 | 9 | class Browser: 10 | def __init__(self, os, dir=None): 11 | if not os: 12 | raise ValueError('Browser created without a OS defined!') 13 | 14 | self.os = os 15 | 16 | if dir: 17 | self.directory = dir 18 | else: 19 | self.directory = path.expanduser('~') 20 | 21 | def find(self): 22 | """Searches for the Browser and returns True 23 | if it finds its""" 24 | # Override Me 25 | pass 26 | 27 | def extensions(self): 28 | """Main method which handles the processing of extentsions 29 | """ 30 | # Override Me 31 | pass 32 | 33 | 34 | -------------------------------------------------------------------------------- /extension_finder/Finder.py: -------------------------------------------------------------------------------- 1 | """ 2 | Finder.py - 3 | @brad_anton 4 | 5 | Simple Script to identify which browser extensions are installed on a system. 6 | 7 | """ 8 | import platform 9 | from tabulate import tabulate 10 | 11 | from Constants import MacBrowsers, WinBrowsers 12 | from Browsers.Chrome import Chrome 13 | from Browsers.InternetExplorer import InternetExplorer 14 | 15 | 16 | class Finder: 17 | def __init__(self, directory=None): 18 | operating_system = platform.system() 19 | 20 | self.os = None 21 | 22 | if operating_system == 'Darwin': 23 | self.os = MacBrowsers 24 | elif operating_system == 'Windows': 25 | self.os = WinBrowsers 26 | else: 27 | print "[!] Unsupported Operating System!!" 28 | return 29 | 30 | def print_extensions(self): 31 | c = Chrome(self.os) 32 | print tabulate(c.extensions(), headers="keys") 33 | 34 | if self.os == WinBrowsers: 35 | i = InternetExplorer(self.os) 36 | print tabulate(i.extensions(), headers="keys") 37 | 38 | 39 | if __name__ == '__main__': 40 | f = Finder() 41 | f.print_extensions() 42 | 43 | -------------------------------------------------------------------------------- /extension_finder/Browsers/InternetExplorer.py: -------------------------------------------------------------------------------- 1 | """ 2 | InternetExplorer.py - 3 | @brad_anton 4 | 5 | """ 6 | from Browser import Browser 7 | from Extension import Extension 8 | 9 | from os import path, walk 10 | try: 11 | import _winreg 12 | except ImportError: 13 | pass 14 | 15 | class InternetExplorer(Browser): 16 | def find(self): 17 | """Searches for the Browser and returns True 18 | if it finds its""" 19 | return path.exists(self.os.IE) 20 | 21 | def extensions(self): 22 | """Main method which handles the processing of extentsions 23 | """ 24 | 25 | extensions = [] 26 | 27 | if self.find(): 28 | """Internet Explorer has a bunch of registry keys for 29 | extensions, so we'll hold two connections open for the 30 | querying""" 31 | hklm = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE) 32 | hkcu = _winreg.ConnectRegistry(None, _winreg.HKEY_CURRENT_USER) 33 | 34 | for registry_key in self.os.IE_REGKEYS: 35 | 36 | key = None 37 | idx = 0 38 | 39 | if registry_key['hive_str'] == 'HKLM': 40 | hive = hklm 41 | elif registry_key['hive_str'] == 'HKCU': 42 | hive = hkcu 43 | 44 | try: 45 | key = _winreg.OpenKey(hive, registry_key['path']) 46 | while True: 47 | if registry_key['type'] == 'key': 48 | entry = _winreg.EnumKey(key, idx) 49 | clsid_key = '{}\\{}'.format(registry_key['path'], entry) 50 | 51 | """For registry keys of type 'key', we open the key 52 | and attempt to find a specific ClsidExtension value 53 | to use as the CLSID. If it fails, we just use the 54 | key name itself. 55 | """ 56 | clsid = self.__get_clsid(hive, clsid_key) 57 | if not clsid: 58 | clsid = entry 59 | else: 60 | clsid = _winreg.EnumValue(key, idx)[0] 61 | 62 | id, name, dll = self.__lookup_clsid(clsid) 63 | #e = Extension(self.os.IE_NAME, name, None, dll, id) 64 | e = Extension(name, None, dll, id) 65 | extensions.append(e.todict()) 66 | 67 | idx += 1 68 | except WindowsError: 69 | pass 70 | 71 | else: 72 | print '[!] Could not find Internet Explorer Extensions!' 73 | 74 | return extensions 75 | 76 | def __get_clsid(self, hive, key): 77 | """Gets a CLSID from the IE Extensions registry key 78 | """ 79 | clsid = None 80 | try: 81 | k = _winreg.OpenKey(hive, key) 82 | clsid = _winreg.QueryValueEx(k, 'ClsidExtension')[0] 83 | except WindowsError: 84 | pass 85 | 86 | return clsid 87 | 88 | def __lookup_clsid(self, clsid): 89 | """Look up a CLSID in the Windows Registry and 90 | returns its name and DLL path 91 | """ 92 | name = None 93 | dll = None 94 | try: 95 | name_key = '{}\\{}'.format(self.os.CLSID,clsid) 96 | k = _winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE, name_key) 97 | name = _winreg.QueryValue(k, None) 98 | 99 | dll_key = '{}\\InProcServer32'.format(name_key) 100 | k = _winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE, dll_key) 101 | dll = _winreg.QueryValueEx(k, None)[0] 102 | except WindowsError: 103 | pass 104 | 105 | return clsid, name, dll 106 | -------------------------------------------------------------------------------- /extension_finder/Constants.py: -------------------------------------------------------------------------------- 1 | """ 2 | Constants.py 3 | @brad_anton 4 | 5 | Constant variables. 6 | 7 | Path names are prefexed by HOMEDIR unless starting 8 | with a slash 9 | 10 | """ 11 | 12 | from enum import Enum 13 | 14 | import platform 15 | 16 | 17 | class RegistryKey: 18 | def __init__(self, path, type='value'): 19 | from _winreg import HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER 20 | self.type = type 21 | self.hive = None 22 | self.hive_str = path[:4] 23 | self.path = path[5:] 24 | 25 | if self.hive_str == 'HKLM': 26 | self.hive = HKEY_LOCAL_MACHINE 27 | elif self.hive_str == 'HKCU': 28 | self.hive = HKEY_CURRENT_USER 29 | 30 | 31 | class MacBrowsers(Enum): 32 | SLASH = '/' 33 | CHROME = '/Applications/Google Chrome.app' 34 | CHROME_NAME = 'Chrome - MacOSX' 35 | CHROME_EXTENSIONS = 'Library/Application Support/Google/Chrome/Default/Extensions' 36 | CHROME_EXTENSIONS_PREFS = 'Library/Application Support/Google/Chrome/Default/Preferences' 37 | 38 | SAFARI = '/Applications/Safari.app' 39 | IE = None 40 | 41 | class WinBrowsers(Enum): 42 | SLASH = '\\' 43 | CHROME = r'C:\Program Files\Google\Chrome\Application\chrome.exe' 44 | CHROME_NAME = 'Chrome - Windows' 45 | CHROME_EXTENSIONS = r'AppData\Local\Google\Chrome\User Data\Default\Extensions' 46 | CHROME_EXTENSIONS_PREFS = r'AppData\Local\Google\Chrome\User Data\Default\Preferences' 47 | 48 | 49 | if platform.system() == 'Windows': 50 | import _winreg 51 | IE = r'C:\Program Files\Internet Explorer\iexplore.exe' 52 | IE_NAME = 'Internet Explorer' 53 | IE_BHO = RegistryKey(r'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects').__dict__ 54 | IE_BHO_64 = RegistryKey(r'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects').__dict__ 55 | IE_URL_SEARCHHOOKS = RegistryKey(r'HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks').__dict__ 56 | IE_TOOLBAR = RegistryKey(r'HKLM\Software\Microsoft\Internet Explorer\Toolbar').__dict__ 57 | IE_TOOLBAR_64 = RegistryKey(r'HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar').__dict__ 58 | IE_EXPLORERBAR_CU = RegistryKey(r'HKCU\Software\Microsoft\Internet Explorer\Explorer Bars').__dict__ 59 | IE_EXPLORERBAR_LM = RegistryKey(r'HKLM\Software\Microsoft\Internet Explorer\Explorer Bars').__dict__ 60 | IE_EXPLORERBAR_CU64 = RegistryKey(r'HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars').__dict__ 61 | IE_EXPLORERBAR_LM64 = RegistryKey(r'HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars').__dict__ 62 | IE_EXTENSIONS_CU = RegistryKey(r'HKCU\Software\Microsoft\Internet Explorer\Extensions', 'key').__dict__ 63 | IE_EXTENSIONS_LM = RegistryKey(r'HKLM\Software\Microsoft\Internet Explorer\Extensions', 'key').__dict__ 64 | IE_EXTENSIONS_CU64 = RegistryKey(r'HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions', 'key').__dict__ 65 | IE_EXTENSIONS_LM64 = RegistryKey(r'HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions', 'key').__dict__ 66 | # New For Win8: 67 | # https://msdn.microsoft.com/en-us/library/dd433050(v=vs.85).aspx 68 | IE_EXTENSIONS_ACTIVEX = RegistryKey(r'HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats', 'key').__dict__ 69 | 70 | 71 | IE_REGKEYS = [ IE_BHO, 72 | IE_BHO_64, 73 | IE_URL_SEARCHHOOKS, 74 | IE_TOOLBAR, 75 | IE_TOOLBAR_64, 76 | IE_EXPLORERBAR_CU, 77 | IE_EXPLORERBAR_LM, 78 | IE_EXPLORERBAR_CU64, 79 | IE_EXPLORERBAR_LM64, 80 | IE_EXTENSIONS_CU, 81 | IE_EXTENSIONS_LM, 82 | IE_EXTENSIONS_CU64, 83 | IE_EXTENSIONS_LM64, 84 | IE_EXTENSIONS_ACTIVEX ] 85 | 86 | CLSID = r'SOFTWARE\Classes\CLSID' 87 | 88 | 89 | 90 | 91 | -------------------------------------------------------------------------------- /extension_finder/Browsers/Chrome.py: -------------------------------------------------------------------------------- 1 | """ 2 | Chrome.py - 3 | @brad_anton 4 | 5 | """ 6 | from Browser import Browser 7 | from Extension import Extension 8 | 9 | from os import path, walk 10 | import json 11 | 12 | class Chrome(Browser): 13 | def find(self): 14 | """Searches for the Browser and returns True 15 | if it finds its""" 16 | return path.exists(self.os.CHROME) 17 | 18 | def extensions(self): 19 | """Main method which handles the processing of extentsions 20 | """ 21 | 22 | result = None 23 | 24 | if self.find(): 25 | try: 26 | result = self.__check_preferences_json('{}{}{}'.format(self.directory, 27 | self.os.SLASH, 28 | self.os.CHROME_EXTENSIONS_PREFS)) 29 | except (KeyError, IOError): 30 | print '[+] Could not parse the Chrome Preferences JSON, falling back to extensions directory' 31 | result = self.__check_app_directory('{}{}{}'.format(self.directory, 32 | self.os.SLASH, 33 | self.os.CHROME_EXTENSIONS)) 34 | else: 35 | print '[!] Could not find Chrome Extensions!' 36 | 37 | return result 38 | 39 | def __check_preferences_json(self, preferences): 40 | """Pulls Extension information out of the preferences file 41 | """ 42 | extensions = [] 43 | with open(preferences, 'rb') as f: 44 | prefs_json = json.load(f) 45 | 46 | extensions_json = prefs_json['extensions']['settings'] 47 | for extension in extensions_json.iterkeys(): 48 | name = None 49 | version = None 50 | if 'manifest' in extensions_json[extension]: 51 | name = extensions_json[extension]['manifest']['name'] 52 | version = extensions_json[extension]['manifest']['version'] 53 | #e = Extension(self.os.CHROME_NAME, name, version, None, extension) 54 | e = Extension(name, version, None, extension) 55 | extensions.append(e.todict()) 56 | 57 | return extensions 58 | 59 | def __process_manifest_json(self, fullpath): 60 | """The manifest.json files contain less information 61 | then the Preferences files, so we'll use this menthod 62 | on if the preferences file is unavaible""" 63 | extension = fullpath.split(self.os.SLASH)[-3] 64 | 65 | if path.isfile(fullpath): 66 | with open(fullpath, 'rb') as f: 67 | manifest = json.load(f) 68 | 69 | name = manifest['name'] 70 | version = manifest['version'] 71 | 72 | return name, version, extension 73 | 74 | def __check_app_directory(self, extension_dirs): 75 | """Checks each directory in self.dirs for stuff 76 | """ 77 | extensions = [] 78 | 79 | for root, dirs, files in walk(extension_dirs): 80 | for f in files: 81 | if f == 'manifest.json': 82 | manifest = path.join(root, f) 83 | name, version, extension = self.__process_manifest_json(manifest) 84 | if name[0] == '_': 85 | # Check locale for more friendlier name 86 | locale_paths = [ '_locales{0}en_US{0}messages.json'.format(self.os.SLASH), 87 | '_locales{0}en{0}messages.json'.format(self.os.SLASH)] 88 | for locale_path in locale_paths: 89 | locale_json = path.join(root, locale_path) 90 | if path.isfile(locale_json): 91 | with open(locale_json, 'rb') as f: 92 | locale_manifest = json.load(f) 93 | if 'appName' in locale_manifest: 94 | if 'message' in locale_manifest['appName']: 95 | name = locale_manifest['appName']['message'] 96 | elif 'extName' in locale_manifest: 97 | if 'message' in locale_manifest['extName']: 98 | name = locale_manifest['extName']['message'] 99 | elif 'app_name' in locale_manifest: 100 | if 'message' in locale_manifest['app_name']: 101 | name = locale_manifest['app_name']['message'] 102 | 103 | #e = Extension(self.os.CHROME_NAME, name, version, None, extension) 104 | e = Extension(name, version, None, extension) 105 | extensions.append(e.todict()) 106 | 107 | return extensions 108 | 109 | -------------------------------------------------------------------------------- /FindIEExtensions.ps1: -------------------------------------------------------------------------------- 1 | <# 2 | .SYNOPSIS 3 | Dumps all install Internet Explorer Extensions (add-ons) 4 | 5 | .DESCRIPTION 6 | Walks the registry to identify Internet Explorer Extensions for the currently logged in user 7 | 8 | .INPUTS 9 | None 10 | 11 | .OUTPUTS 12 | None (Screen Only) 13 | 14 | .NOTES 15 | Version: 0.1 16 | Author: @brad_anton (OpenDNS) 17 | Creation Date: June 1, 2016 18 | Purpose/Change: Initial script development 19 | 20 | .EXAMPLE 21 | 22 | FindIEExtensions.ps1 23 | DLL Name CLSID 24 | --- ---- ----- 25 | C:\Windows\System32\ieframe.dll Microsoft Url Search Hook {CFBFAE00-17A6-11D0-9... 26 | C:\Windows\System32\msxml3.dll XML DOM Document {2933BF90-7B36-11D2-B... 27 | C:\Windows\System32\Macromed\Flash\Flash.ocx Shockwave Flash Object {D27CDB6E-AE6D-11CF-9... 28 | C:\Windows\Downloaded Program Files\ieatgpc.dll GpcContainer Class {E06E2E99-0AA1-11D4-A... 29 | C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll Send to OneNote from Internet Explorer button {48E73304-E1D6-4330-9... 30 | C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll Linked Notes button {FFFDC614-B694-4AE6-A... 31 | #> 32 | 33 | <# 34 | Utility Functions 35 | #> 36 | 37 | function Lookup-Clsid 38 | { 39 | Param([string]$clsid) 40 | $CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID' 41 | 42 | If ( Test-Path $CLSID_KEY\$clsid) { 43 | $name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)' 44 | $dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)' 45 | } 46 | $name, $dll 47 | } 48 | 49 | function Make-Extension 50 | { 51 | Param([string]$clsid, [string]$name, [string]$dll) 52 | 53 | $extension = New-Object PSObject -Prop (@{'CLSID' = $clsid; 54 | 'Name' = $name; 55 | 'DLL' = $dll }) 56 | 57 | $extension 58 | } 59 | 60 | # Resulting list of Extension Properties 61 | $extensions = @() 62 | 63 | 64 | <# 65 | Extensions are identified in these Keys as properties containing the 66 | CLSID. 67 | #> 68 | 69 | $registry_keys = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects', 70 | 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects', 71 | 'HKCU:\Software\Microsoft\Internet Explorer\UrlSearchHooks', 72 | 'HKLM:\Software\Microsoft\Internet Explorer\Toolbar', 73 | 'HKLM:\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar', 74 | 'HKCU:\Software\Microsoft\Internet Explorer\Explorer Bars', 75 | 'HKLM:\Software\Microsoft\Internet Explorer\Explorer Bars', 76 | 'HKCU:\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars', 77 | 'HKLM:\Software\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars' 78 | ) 79 | 80 | ForEach ($key in $registry_keys) { 81 | If (Test-Path $key ) { 82 | $clsids = Get-Item -Path $key | Select-Object -Property Property | ForEach-Object Property 83 | ForEach ( $clsid in $clsids ) 84 | { 85 | $name, $dll = Lookup-Clsid $clsid 86 | $extension = Make-Extension $clsid $name $dll 87 | $extensions += $extension 88 | } 89 | } 90 | } 91 | 92 | 93 | 94 | <# 95 | Extensions are identified in these keys as subkeys named as the CLSID 96 | #> 97 | 98 | $registry_keys = @( 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Ext\Stats' ) 99 | 100 | ForEach ($key in $registry_keys) { 101 | If (Test-Path $key ) { 102 | $clsids = Get-ChildItem $key -Name 103 | ForEach ( $clsid in $clsids ) 104 | { 105 | $name, $dll = Lookup-Clsid $clsid 106 | $extension = Make-Extension $clsid $name $dll 107 | $extensions += $extension 108 | } 109 | } 110 | } 111 | 112 | 113 | <# 114 | Extensions are identified in these keys as Values for the ClsidExtension 115 | Property within a subkeys named as some other ID. 116 | #> 117 | 118 | $registry_keys = @( 'HKCU:\Software\Microsoft\Internet Explorer\Extensions', 119 | 'HKLM:\Software\Microsoft\Internet Explorer\Extensions', 120 | 'HKCU:\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions', 121 | 'HKLM:\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions' ) 122 | 123 | 124 | ForEach ($key in $registry_keys) { 125 | If (Test-Path $key ) { 126 | $ids = Get-ChildItem $key -Name 127 | ForEach ( $id in $ids ) 128 | { 129 | $clsid = (Get-ItemProperty -Path $key\$id -Name ClsidExtension).'ClsidExtension' 130 | $name, $dll = Lookup-Clsid $clsid 131 | $extension = Make-Extension $clsid $name $dll 132 | $extensions += $extension 133 | } 134 | } 135 | } 136 | 137 | # Print Perty Table :) 138 | $extensions | Format-Table -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Extension Finder 2 | 3 | Attempts to find installed browser extensions (sometimes called add-ons or plug-ins, depending on the browser). 4 | 5 | ## Features 6 | Lists all available information for a given extension. Currently supports: 7 | 8 | * Chrome 9 | * Internet Explorer (Windows Only) 10 | 11 | All features were tested on Windows 8.1 and MacOSX 10.11 12 | 13 | ## Install 14 | 15 | With the repository cloned, create a virtual environment: 16 | 17 | ``` 18 | cd extension_finder 19 | virtualenv venv 20 | ``` 21 | 22 | Activate the VirtualEnv on MacOSX with: 23 | ``` 24 | source venv/bin/activate 25 | ``` 26 | 27 | Activate it on Windows with: 28 | ``` 29 | venv\Scripts\activate 30 | ``` 31 | 32 | Then install all requirements: 33 | ``` 34 | pip install -r requirements.txt 35 | ``` 36 | 37 | ## Usage 38 | 39 | Just run `extension_finder.py` from within the virtual environment. 40 | 41 | ### Chrome Preferences JSON 42 | 43 | Chrome will store all of its Extension information within a `Preferences` file, if `extension_finder` 44 | can locate this file, you'll get good info from it: 45 | 46 | ``` 47 | $ python extension_finder.py 48 | 49 | version name id 50 | --------- -------------------------------------- -------------------------------- 51 | 0.1 Chrome mgndgikekgjfcpckkfioiadnlibdjbkf 52 | 1.0.1 Cisco WebEx Extension jlhmfgmfgeifomenelglieieghnjghma 53 | 14.1 Google Drive apdfllckaahabafndbhieahigkjlhalf 54 | 0.2.3 Spotify - Music for every moment cnkjkdjlofllcpbemipjbcpfnglbgieh 55 | 0.2 Web Store ahfgeienlihckogmohjhadlkjgocpleb 56 | 3.0.15 Readability oknpjjbmpnndlpmnhmekjpocelpnlfdi 57 | 1.1 Google Sheets felcaaldnbdncclmgdcncolpebgiejap 58 | 1.2.0 Google Hangouts nkeimhogjdpnpccoofpliimaahmaaome 59 | 1.0 Google Network Speech neajdppkdcdipfabeoofebfddakdcjhd 60 | 0.9.38 CryptoTokenExtension kmendfapggjehodndflmmgagdbamhnfd 61 | bepbmhgboaologfdajaanbcjmnhjmhfn 62 | 0.0.1.4 Hotword triggering nbpagnldghgfoolbancepceaanlmhfmd 63 | 0.1 Cloud Print mfehgcgbbipciphmccgaenjidiccnmng 64 | 34 feedly hipbfijinpcgfogaopmgehiegacbhmob 65 | 1.0.8 Evernote Web lbfehkoinhhcknnbdgnnmjhiladcgbol 66 | 1.0 Feedback gfdkimpbcpahaombhbimeihdjnejgicl 67 | 1.4 Google Docs Offline ghbmnnjooekpmoecnnnilnnbdlolhkhi 68 | 2.0.6 Google Translate aapbdbdomjkkjkaonfhkkikfgjllcleb 69 | 0.9 Google Slides aapocclcgogkmnckokdopfmhonfmgoek 70 | 1 Chrome PDF Viewer mhjfbmdgcfjbbpaeojofohoefgiehjai 71 | 0.1 Bookmark Manager eemcgdkfndhakfknompkggombfjjjeno 72 | 0.2 Settings ennkphjdgehloodpbhlhldgbnhmacadg 73 | 0.0.1 GaiaAuthExtension mfffpogegjflfpflabcdkioaeobkgjik 74 | 8.1 Gmail pjkljhegncpnkpknbcohdijeoejaedia 75 | 0.0.0.30 Google Search coobgpohoikkiipiblmjeljniedjpjpf 76 | 1.0.0.0 Chrome Web Store Payments nmmhkkegccagdldgiimedpiccmgmieda 77 | 1.0.3 Slack jeogkiiogjbmhklcnbgkdcjoioegiknm 78 | 4.2.8 YouTube blpcfgokakmgnkcojhhkbfbldkacnbeo 79 | 0.9 Google Docs aohghmighlieiainnegkcijnfilokake 80 | ``` 81 | 82 | ### Chrome Manifest.json Files 83 | 84 | If `extension_finder.py` cannot find the `Preferences` file, it will traverse the home directory of the 85 | user it is being run under looking for `manifest.json` files. These often contain less rich information, 86 | but do give you some idea of whats installed. The extension IDs can also be looked up in the Chrome extension 87 | store. Note that you'll get a warning message that it could not parse the Chrome Preferences JSON. 88 | 89 | ``` 90 | C:\\extension_finder\\> python extension_finder.py 91 | [+] Could not parse the Chrome Preferences JSON, falling back to extensions directory 92 | version name id 93 | --------- ------------------------- -------------------------------- 94 | 0.9 Google Slides aapocclcgogkmnckokdopfmhonfmgoek 95 | 0.9 Google Docs aohghmighlieiainnegkcijnfilokake 96 | 14.1 Google Drive apdfllckaahabafndbhieahigkjlhalf 97 | 1.0.6.92 Search Manager bahkljhhdeciiaodlkppoonappfnheoi 98 | 4.2.8 YouTube blpcfgokakmgnkcojhhkbfbldkacnbeo 99 | 1.1 Google Sheets felcaaldnbdncclmgdcncolpebgiejap 100 | 1.4 Google Docs Offline ghbmnnjooekpmoecnnnilnnbdlolhkhi 101 | 1.0.0.0 Chrome Web Store Payments nmmhkkegccagdldgiimedpiccmgmieda 102 | 8.1 Gmail pjkljhegncpnkpknbcohdijeoejaedia 103 | ``` 104 | 105 | ### Internet Explorer 106 | 107 | Internet Explorer stores all of its extension information in the registry, which makes it straightforward to dump: 108 | 109 | ``` 110 | C:\\extension_finder\\> python extension_finder.py 111 | path name id 112 | ------------------------------------------------------------------ --------------------------------------------- -------------------------------------- 113 | C:\Windows\System32\ieframe.dll Microsoft Url Search Hook {CFBFAE00-17A6-11D0-99CB-00C04FD64497} 114 | C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll Send to OneNote from Internet Explorer button {48E73304-E1D6-4330-914C-F5F514E3486C} 115 | C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll Linked Notes button {FFFDC614-B694-4AE6-AB38-5D6374584B52} 116 | %SystemRoot%\System32\msxml3.dll XML DOM Document {2933BF90-7B36-11D2-B20E-00C04F983E60} 117 | C:\Windows\System32\Macromed\Flash\Flash.ocx Shockwave Flash Object {D27CDB6E-AE6D-11CF-96B8-444553540000} 118 | C:\Windows\Downloaded Program Files\ieatgpc.dll GpcContainer Class {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} 119 | ``` 120 | 121 | ## PowerShell 122 | 123 | Since not everyone uses Python on Windows, there is also a `FindIEExtensions.ps1` PowerShell script. To run it simply: 124 | 125 | ``` 126 | PS C:\Users\User\Desktop\extension_finder> .\FindIEExtensions.ps1 127 | 128 | DLL Name CLSID 129 | --- ---- ----- 130 | C:\Windows\System32\ieframe.dll Microsoft Url Search Hook {CFBFAE00-17A... 131 | C:\Windows\System32\msxml3.dll XML DOM Document {2933BF90-7B3... 132 | C:\Windows\System32\Macromed\Flash\Flash.ocx Shockwave Flash Object {D27CDB6E-AE6... 133 | C:\Windows\Downloaded Program Files\ieatgpc.dll GpcContainer Class {E06E2E99-0AA... 134 | C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll Send to OneNote from Internet Explorer button {48E73304-E1D... 135 | C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll Linked Notes button {FFFDC614-B69... 136 | ``` 137 | --------------------------------------------------------------------------------