+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: [HC Official] MozillaRecovery - crack master passwords (/Thread-HC-Official-MozillaRecovery-crack-master-passwords)
Pages:
1
2
[HC Official] MozillaRecovery - crack master passwords - Deque - 12-26-2012
MozillaRecovery
Requirements: Java 7
![[Image: l7e9kgas.png]](http://s7.directupload.net/images/121226/l7e9kgas.png)
About the program
Once you start the program, it searches automatically for default locations of your key3.db in Firefox and, if not found, in the Thunderbird application directory. I prepared and tested this for Windows 7 and Linux. If it is not working for your OS, please tell me the default location for it. I just need the information to put that in. You can change the location by hand, of course.
key3.db is the file that is used to recover the master password. You can start a wordlist attack on that. The program ships with a default worldlist, but it is small (I didn't want to upload a wordlist file that adds several megabytes to the program). You can use your own list by changing the location.
Alternatively you can generate the words by activating the "generate words" checkbox. Although I used threads, word generation is limited to a word length of five (a bruteforce attack with a wordlength of six would take several days, so I don't allow that) and the alphabet a-zA-Z by now. I got about 30000 password tests per second on my machine.
Once you got the master password, it is very easy to obtain saved login information from signons.sqlite, since both, Thunderbird and Firefox, will show usernames and passwords in plain text. (google if you don't know how)
Conclusion: Always set a master password if you save login information with Thunderbird or Firefox. Otherwise the login information can be obtained without any problems.
About the Source
The only (non-standard) library I used is apache.log4j for logging purposes. You will see a properties file and a log folder. The standard logging level is WARN. If you change this level to INFO or DEBUG, the master passwords found with the program will be saved in there, so be careful with that option.
Lines of code without comments and empty lines: 914
Lines of code with everything else: 1141
The code was tested for: Firefox 9.01 Thunderbird 9.01, Windows XP, Vista, 7, Arch Linux
Problems?
Please make sure that you have Java 7.
If there are still problems, post the logging file that is in the logs folder.
Source: https://github.com/katjahahn/MozillaRecovery
Program: [attachment=86]
RE: [HC Official] MozillaRecovery - crack master passwords - bluedog.tar.gz - 12-28-2012
I love this guy, awesome, thanks once again !
RE: [HC Official] MozillaRecovery - crack master passwords - The Alchemist - 12-28-2012
^^^^ Agreed... The more I see of him, the more I respect him.
RE: [HC Official] MozillaRecovery - crack master passwords - mikahlamka - 12-28-2012
Wow nice program there
even though I'm not using firefox.. But great work :epic:
RE: [HC Official] MozillaRecovery - crack master passwords - mikahlamka - 12-28-2012
Wow nice program there
even though I'm not using firefox.. But great work :epic:
RE: [HC Official] MozillaRecovery - crack master passwords - Lottex - 01-06-2013
Thanks once again dude great job keep it going
RE: [HC Official] MozillaRecovery - crack master passwords - Twistt. - 02-22-2013
Great Share & Amazing Features, Really Helpful! Keep it up.
RE: [HC Official] MozillaRecovery - crack master passwords - Twistt. - 02-22-2013
Great Share & Amazing Features, Really Helpful! Keep it up.
RE: [HC Official] MozillaRecovery - crack master passwords - chmod - 08-23-2013
(08-22-2013, 10:34 PM)Zooker Wrote: That is Realy Cool Thanks
Don't spam "thanks all over the forum, use the thanks button it was designed to eliminate the need for posts such as these
RE: [HC Official] MozillaRecovery - crack master passwords - chmod - 08-23-2013
(08-22-2013, 10:34 PM)Zooker Wrote: That is Realy Cool Thanks
Don't spam "thanks all over the forum, use the thanks button it was designed to eliminate the need for posts such as these