├── README.md
├── cmd
└── chromedb
│ └── main.go
├── cookies.go
├── go.mod
├── go.sum
├── localstorage.go
└── sessionstorage.go
/README.md:
--------------------------------------------------------------------------------
1 |
2 | 
Because chromiumdb is a bit of a mouthful for a Go package name.
3 |
4 |
5 | Read Chromium data (namely, cookies and local storage) straight from disk—_without_ spinning up the browser. I primarily use this to extract tokens from authenticated browser sessions for use in automation, scraping, etc.
6 |
7 | ## Description
8 |
9 | Chromium-based browsers store cookies and local storage in the following respective databases within the profile directory:
10 |
11 | Path | Format | Encrypted
12 | --- | --- | ---
13 | `Cookies` | SQLite | Yes
14 | `Local Storage/leveldb/` | LevelDB | No
15 |
16 | This tool reads from those databases, decrypts where necessary, and outputs the data in JSON format for easy parsing on CLI.
17 |
18 | ## Getting started
19 |
20 | ### Prerequisites
21 |
22 | This has only been tested with Arc browser on macOS, but should work with any Chromium-based browser. I'd accept a PR to support decrypting cookies on other operating systems.
23 |
24 | ### Install
25 |
26 | ```bash
27 | 𝄢 go install -v github.com/noperator/chromedb/cmd/chromedb@latest
28 | ```
29 |
30 | ### Usage
31 |
32 | ```bash
33 | 𝄢 chromedb -h
34 | Usage of chromedb:
35 | -c cookies
36 | -ls
37 | local storage
38 | -p string
39 | path to browser profile directory
40 |
41 | ```
42 |
43 | To decrypt cookies for Chromium-based Arc browser, we need to first get its password from the keychain.
44 |
45 | ```bash
46 | 𝄢 export BROWSER_PASSWORD=$(security find-generic-password -wga Arc)
47 | 𝄢 chromedb -c -p ~/Library/Application\ Support/Arc/User\ Data/Profile\ 1/ |
48 | shuf -n 2 |
49 | jq '.encrypted_value = ""'
50 |
51 | {
52 | "domain": ".geeksforgeeks.org",
53 | "name": "gfg_theme",
54 | "encrypted_value": "",
55 | "value": "gfgThemeDark"
56 | }
57 | {
58 | "domain": "www.citrix.com",
59 | "name": "renderid",
60 | "encrypted_value": "",
61 | "value": "rend01"
62 | }
63 | ```
64 |
65 | Local storage is unencrypted and doesn't require a password.
66 |
67 | ```bash
68 | 𝄢 chromedb -ls -p ~/Library/Application\ Support/Arc/User\ Data/Profile\ 1/ |
69 | shuf -n 2 |
70 | jq
71 |
72 | {
73 | "storage_key": "https://docs.paloaltonetworks.com",
74 | "script_key": "ClientSidePersistence",
75 | "charset": "ISO-8859-1",
76 | "mime": "text/plain",
77 | "conversions": [
78 | "strconv.Quote"
79 | ],
80 | "value": "ClientContext/CLIENTCONTEXT:=visitorId%3D"
81 | }
82 | {
83 | "storage_key": "https://github.com",
84 | "script_key": "ref-selector:greasysock/railscookie:branch",
85 | "charset": "ISO-8859-1",
86 | "mime": "application/json",
87 | "conversions": [],
88 | "value": {
89 | "refs": [
90 | "master"
91 | ],
92 | "cacheKey": "v0:1554731422.0"
93 | }
94 | }
95 | ```
96 |
97 | ## Back matter
98 |
99 | ### See also
100 |
101 | Three outstanding posts from CCL Solutions Group that helped me understand Chromium data storage:
102 | - [LevelDB](https://www.cclsolutionsgroup.com/post/hang-on-thats-not-sqlite-chrome-electron-and-leveldb)
103 | - [IndexedDB](https://www.cclsolutionsgroup.com/post/indexeddb-on-chromium)
104 | - [Local storage](https://www.cclsolutionsgroup.com/post/chromium-session-storage-and-local-storage)
105 |
106 | I almost didn't write this tool as there are many others that do this kind of thing already. The most widely used ones are written in Python ([`pycookiecheat`](https://github.com/n8henrie/pycookiecheat/blob/dev/src/pycookiecheat/chrome.py) for cookies, [`ccl_chrome_indexeddb`](https://github.com/cclgroupltd/ccl_chrome_indexeddb/blob/master/ccl_chromium_localstorage.py) for local storage)—but I avoid using Python if possible due [nightmarish environment management](https://xkcd.com/1987/). There are a few Go-based cookie-dumping utilities, but they:
107 |
108 | - don't read from disk, and instead abuse the [remote debugging port](https://blog.chromium.org/2011/05/remote-debugging-with-chrome-developer.html) to launch a browser and dump unencrypted cookies ([`WhiteChocolateMacademiaNut`](https://github.com/slyd0g/WhiteChocolateMacademiaNut), [`chromecookiestealer`](https://github.com/magisterquis/chromecookiestealer), [`chrome-dump`](https://github.com/lesnuages/chrome-dump), [`go-chrome-stealer`](https://github.com/omaidf/go-chrome-stealer))
109 | - only work on Windows ([`gookies`](https://github.com/CCob/gookies))
110 | - are "obsolete" ([`gostealer`](https://github.com/4kord/gostealer)) or "demo-only" ([`go-stealer`](https://github.com/idfp/go-stealer))
111 | - do read from disk, but either used too many hardcoded values or were too complex for my needs ([`go-chrome-cookies`](https://github.com/teocci/go-chrome-cookies), [`chrome-cookie`](https://github.com/muyids/chrome-cookie), [`ChromeDecryptor`](https://github.com/wat4r/ChromeDecryptor), [`chrome-cookie-cutter`](https://github.com/saranrapjs/chrome-cookie-cutter), [`chrome-cookie-decrypt`](https://github.com/kinghrothgar/chrome-cookie-decrypt), [`chrome-cookies`](https://github.com/igara/chrome-cookies), [`cookies`](https://github.com/creachadair/cookies))
112 |
113 | I wasn't able to find _any_ Go-based tools that specifically parse local storage (though [`leveldb-cli`](https://github.com/cions/leveldb-cli) does read LevelDB, which is a good start).
114 |
115 | (I really did try.)
116 |
117 |
118 | ```bash
119 | # Search for tools written in Go that process Chrom(e|ium)'s cookies or local storage.
120 | for QUERY in \
121 | 'chrome cookie' \
122 | 'chromium cookie' \
123 | 'chrome leveldb' \
124 | 'chromium leveldb' \
125 | 'chrome local storage' \
126 | 'chromium local storage' \
127 | ; do
128 | echo "query: $QUERY" >&2
129 | curl -sv "https://github.com/search?type=repositories" \
130 | -G -X GET --data-urlencode "q=$QUERY language:Go" \
131 | -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' |
132 | tee >/dev/null \
133 | >(htmlq -t .search-title | nl -nln | sed -E 's/(^[0-9]+)/\1.1/') \
134 | >(htmlq 'li > a' -a 'aria-label' | nl -nln | sed -E 's/(^[0-9]+)/\1.2/') |
135 | sort -V |
136 | sed -E 's/^[0-9\.]+\s+//' |
137 | paste -d @ - - |
138 | tee /dev/stderr
139 | sleep 2
140 | done |
141 | sed -E 's/ stars$//' |
142 | sort -u |
143 | tee repos.lst
144 |
145 | # Download all of those tools' repos.
146 | mkdir -p repos
147 | cd repos
148 | cat ../repos.lst | parallel --colsep @ --bar 'git clone --depth 1 https://github.com/{1} $(echo {1} | sed -E "s|/|--|")--{2}'
149 | rm -rf ./*/.git
150 |
151 | # Look for various topics that may or may not indicate that the tool uses the approach I care about.
152 | echo "
153 | sql sql|db|database|query|row
154 | remote ws://|remote|debugg(ing|er)|9222|cdp|dev.?tools|debug.port
155 | keychain log.?in|keychain
156 | crypto key.?length|iteration|aes|cbc|sha1?|pbkdf|cipher|crypt
157 | localStorage ldb|leveldb|local.?storage
158 | " | grep -v '^$' | while read TOPIC REGEX; do
159 | rg -g '!.git*' -g '!topics.jsonl' -c "$REGEX" . | while read RESULT; do
160 | FILE=$(echo "$RESULT" | cut -d : -f 1 | sed -E 's|\./||')
161 | REPO="https://github.com/"$(echo "$FILE" | grep -oE '[^/]+' | head -n 1 | sed -E 's|--|/|; s/--.*//')
162 | STARS=$(echo "$FILE" | grep -oE '\--[0-9]+/' | head -n 1 | grep -oE '[0-9]+')
163 | COUNT=$(echo "$RESULT" | cut -d : -f 2)
164 | jo topic="$TOPIC" repo="$REPO" file="$FILE" count="$COUNT" stars="$STARS"
165 | done
166 | done | tee topics.jsonl
167 |
168 | # Sort relevant repos by popularity.
169 | cat topics.jsonl | jq -sc 'group_by(.repo) | map({
170 | repo: .[0].repo,
171 | stars: .[0].stars,
172 | topics: map({topic, count}) |
173 | group_by(.topic) |
174 | map({topic: .[0].topic, count: map(.count) | add})
175 | }) | sort_by(.stars) | reverse[]'
176 |
177 | {"repo":"https://github.com/slyd0g/WhiteChocolateMacademiaNut","stars":141,"topics":[{"topic":"crypto","count":5},{"topic":"remote","count":17},{"topic":"sql","count":6}]}
178 | {"repo":"https://github.com/magisterquis/chromecookiestealer","stars":92,"topics":[{"topic":"crypto","count":6},{"topic":"keychain","count":3},{"topic":"remote","count":20},{"topic":"sql","count":15}]}
179 | {"repo":"https://github.com/CCob/gookies","stars":48,"topics":[{"topic":"crypto","count":36},{"topic":"sql","count":14}]}
180 | {"repo":"https://github.com/cions/leveldb-cli","stars":27,"topics":[{"topic":"crypto","count":14},{"topic":"localStorage","count":60},{"topic":"sql","count":290}]}
181 | {"repo":"https://github.com/lesnuages/chrome-dump","stars":18,"topics":[{"topic":"crypto","count":11},{"topic":"keychain","count":1},{"topic":"remote","count":13}]}
182 | {"repo":"https://github.com/teocci/go-chrome-cookies","stars":9,"topics":[{"topic":"crypto","count":140},{"topic":"keychain","count":42},{"topic":"sql","count":283}]}
183 | {"repo":"https://github.com/idfp/go-stealer","stars":9,"topics":[{"topic":"crypto","count":73},{"topic":"keychain","count":32},{"topic":"sql","count":66}]}
184 | {"repo":"https://github.com/muyids/chrome-cookie","stars":8,"topics":[{"topic":"crypto","count":22},{"topic":"keychain","count":3},{"topic":"sql","count":25}]}
185 | {"repo":"https://github.com/wat4r/ChromeDecryptor","stars":5,"topics":[{"topic":"crypto","count":107},{"topic":"keychain","count":9},{"topic":"sql","count":35}]}
186 | {"repo":"https://github.com/saranrapjs/chrome-cookie-cutter","stars":5,"topics":[{"topic":"crypto","count":29},{"topic":"sql","count":10}]}
187 | {"repo":"https://github.com/omaidf/go-chrome-stealer","stars":5,"topics":[{"topic":"remote","count":3}]}
188 | {"repo":"https://github.com/kawakatz/macCookies","stars":3,"topics":[{"topic":"crypto","count":68},{"topic":"keychain","count":4},{"topic":"sql","count":30}]}
189 | {"repo":"https://github.com/4kord/gostealer","stars":3,"topics":[{"topic":"crypto","count":52},{"topic":"keychain","count":13},{"topic":"sql","count":242}]}
190 | {"repo":"https://github.com/kinghrothgar/chrome-cookie-decrypt","stars":1,"topics":[{"topic":"crypto","count":45},{"topic":"keychain","count":12},{"topic":"sql","count":55}]}
191 | {"repo":"https://github.com/kalelc/go-rails-cook","stars":1,"topics":[{"topic":"crypto","count":25},{"topic":"sql","count":4}]}
192 | {"repo":"https://github.com/hybridtheory/samesite-cookie-support","stars":1,"topics":[{"topic":"crypto","count":2},{"topic":"sql","count":24}]}
193 | {"repo":"https://github.com/m4tt72/rails-cookie-decrypt-go","stars":0,"topics":[{"topic":"crypto","count":31},{"topic":"sql","count":1}]}
194 | {"repo":"https://github.com/igara/chrome-cookies","stars":0,"topics":[{"topic":"crypto","count":31},{"topic":"sql","count":12}]}
195 | {"repo":"https://github.com/greasysock/railscookie","stars":0,"topics":[{"topic":"crypto","count":13},{"topic":"sql","count":1}]}
196 | {"repo":"https://github.com/corenting/cookies","stars":0,"topics":[{"topic":"crypto","count":24},{"topic":"remote","count":1},{"topic":"sql","count":10}]}
197 | ```
198 |
199 |