• All Platforms
  • Update Firefox to 31.2.0esr
  • Update Torbutton to 1.7.0.1
    • Bug 13378: Prevent addon reordering in toolbars on first-run.
    • Bug 10751: Adapt Torbutton to ESR31's Australis UI.
    • Bug 13138: ESR31-about:tor shows "Tor is not working"
    • Bug 12947: Adapt session storage blocker to ESR 31.
    • Bug 10716: Take care of drag/drop events in ESR 31.
    • Bug 13366: Fix cert exemption dialog when disk storage is enabled.
  • Update Tor Launcher to 0.2.7.0.1
    • Translation updates only
  • Udate fteproxy to 0.2.19
  • Update NoScript to 2.6.9.1
  • Bug 13027: Spoof window.navigator useragent values in JS WebWorker threads
  • Bug 13016: Hide CSS -moz-osx-font-smoothing values.
  • Bug 13356: Meek and other symlinks missing after complete update.
  • Bug 13025: Spoof screen orientation to landscape-primary.
  • Bug 13346: Disable Firefox "slow to start" warnings and recordkeeping.
  • Bug 13318: Minimize number of buttons on the browser toolbar.
  • Bug 10715: Enable WebGL on Windows (still click-to-play via NoScript)
  • Bug 13023: Disable the gamepad API.
  • Bug 13021: Prompt before allowing Canvas isPointIn*() calls.
  • Bug 12460: Several cross-compilation and gitian fixes (see child tickets)
  • Bug 13186: Disable DOM Performance timers
  • Bug 13028: Defense-in-depth checks for OCSP/Cert validation proxy usage
  • Bug 13416: Defend against new SSLv3 attack (poodle).

• All Platforms
  • Update Firefox to 31.2.0esr
  • Udate fteproxy to 0.2.19
  • Update Tor to 0.2.5.8-rc (from 0.2.4.24)
  • Update NoScript to 2.6.9.1
  • Update Torbutton to 1.7.0.1 (from 1.6.12.3)
    • Bug 13378: Prevent addon reordering in toolbars on first-run.
    • Bug 10751: Adapt Torbutton to ESR31's Australis UI.
    • Bug 13138: ESR31-about:tor shows "Tor is not working"
    • Bug 12947: Adapt session storage blocker to ESR 31.
    • Bug 10716: Take care of drag/drop events in ESR 31.
    • Bug 13366: Fix cert exemption dialog when disk storage is enabled.
  • Update Tor Launcher to 0.2.7.0.1 (from 0.2.5.6)
    • Bug 11405: Remove firewall prompt from wizard.
    • Bug 12895: Mention @riseup.net as a valid bridge request email address
    • Bug 12444: Provide feedback when “Copy Tor Log” is clicked.
    • Bug 11199: Improve error messages if Tor exits unexpectedly
    • Bug 12451: Add option to hide TBB's logo
    • Bug 11193: Change "Tor Browser Bundle" to "Tor Browser"
    • Bug 11471: Ensure text fits the initial configuration dialog
    • Bug 9516: Send Tor Launcher log messages to Browser Console
  • Bug 13027: Spoof window.navigator useragent values in JS WebWorker threads
  • Bug 13016: Hide CSS -moz-osx-font-smoothing values.
  • Bug 13356: Meek and other symlinks missing after complete update.
  • Bug 13025: Spoof screen orientation to landscape-primary.
  • Bug 13346: Disable Firefox "slow to start" warnings and recordkeeping.
  • Bug 13318: Minimize number of buttons on the browser toolbar.
  • Bug 10715: Enable WebGL on Windows (still click-to-play via NoScript)
  • Bug 13023: Disable the gamepad API.
  • Bug 13021: Prompt before allowing Canvas isPointIn*() calls.
  • Bug 12460: Several cross-compilation and gitian fixes (see child tickets)
  • Bug 13186: Disable DOM Performance timers
  • Bug 13028: Defense-in-depth checks for OCSP/Cert validation proxy usage
  • Bug 4234: Automatic Update support (off by default)
  • Bug 11641: Reorganize bundle directory structure to mimic Firefox
  • Bug 10819: Create a preference to enable/disable third party isolation
  • Bug 13416: Defend against new SSLv3 attack (poodle).
• Windows:
  • Bug 10065: Enable DEP, ASLR, and SSP hardening options
• Linux:
  • Bug 13031: Add full RELRO hardening protection.
  • Bug 10178: Make it easier to set an alternate Tor control port and password
  • Bug 11102: Set Window Class to "Tor Browser" to aid in Desktop navigation
  • Bug 12249: Don't create PT debug files anymore

Here is the complete changelog for 3.6.4:

• Tor Browser 3.6.4 -- All Platforms
• Update Tor to 0.2.4.23
• Update Tor launcher to 0.2.5.6
• Update OpenSSL to 1.0.1i
• Backported Tor Patches:
• Bug 11654: Properly apply the fix for malformed bug11156 log message
• Bug 11200: Fix a hang during bootstrap introduced in the initial
  bug11200 patch.
• Update NoScript to 2.6.8.36
• Bug 9516: Send Tor Launcher log messages to Browser Console
• Update Torbutton to 1.6.11.1
• Bug 11472: Adjust about:tor font and logo positioning to avoid overlap
• Bug 12680: Fix Torbutton about url.

• Faster startup and responsiveness.
• Huge refactoring and cleanup of the current code.
• The Chromium library was upgraded to the latest release (incredibly fast!).
• Improved compatibility with 64-bit Windows editions.
• Improved source code editor.
• Available as free, open source/community edition (under a BSD-3-Clause license).
• Built using components and libraries from the Catarinka toolkit (also made open source at the same time with this release and under the same license).
• Includes the Selenite Lua library - a multi-purpose set of Lua extensions developed to make the development of Lua extensions easier in Sandcat. The code for Selenite is now open source, under the MIT license. The library documentation is available here.
• Fixed: output of the SHA1 and the full URL encoders that come with the pen-tester pack. 

• All Platforms
• Update Firefox to 24.7.0esr
• Update obfsproxy to 0.2.12
• Update FTE to 0.2.17
• Update NoScript to 2.6.8.33
• Update HTTPS Everywhere to 3.5.3
• Bug 12673: Update FTE bridges
• Update Torbutton to 1.6.11.0
• Bug 12221: Remove obsolete Javascript components from the toggle era
• Bug 10819: Bind new third party isolation pref to Torbutton security UI
• Bug 9268: Fix some window resizing corner cases with DPI and taskbar size.
• Linux:
  • Bug 11102: Set Window Class to "Tor Browser" to aid in Desktop navigation
  • Bug 12249: Don't create PT debug files anymore

• A web application security testing framework built on top of a browser.
• Supports Windows, Linux(both 32 and 64 bit) and Macintosh.
• Can work with other software like ZAP using built in proxy management function which makes it much more convenient.
• Available in 9 languages: Arabic, Chinese – Simplified, Chinese – Traditional, English, French, Portuguese, Russian, Spanish and Turkish
• Comes installed with major security distributions including BackTrack and Matriux

• This utility works in any version of Windows, starting from Windows XP and up to Windows 8. Both 32-bit and 64-bit systems are supported.
• The following Web browsers are supported: Internet Explorer, Mozilla Firefox, SeaMonkey, and Google Chrome.
• ImageCacheViewer won't work if you configure your Web browser to clear the cache after closing it.
• It's recommended to close all windows of your Web browser before using ImageCacheViewer, to ensure that all cache files are saved to the disk.

Start Using ImageCacheViewer

• Live HTTP Headers — built-in live headers with a dedicated cache per tab and support for preview extensions
• Sandcat Console — an extensible command line console; Allows you to easily run custom commands and scripts in a loaded page
• Resources tab — allows you to view the page resources, such as JavaScript files and other web files.
• Page Menu extensions — allows you to view details about a page and more.
• Pen-Tester Tools — Sandcat comes with a multitude of pen-test oriented extensions. This includes a Fuzzer, a Script Runner, HTTP & XHR Editors, Request Loader, Request Replay capabilities and more.

• Multi-Process Architecture — each tab is its own process
• Developer Tools — in addition to the Chromium Developer Tools, Sandcat comes with a Source Code Editor and its own JavaScript and Lua consoles.

as the Tor Package archive.

• All Platforms
• Update Tor to 0.2.4.19
• Update Tor Launcher to 0.2.4.2
  • Bug 10382: Fix a Tor Launcher hang on TBB exit
• Update Torbutton to 1.6.5.2
• Misc: Switch update download URL back to download-easy    

• Fixed gate keeper – unidentified developer code signing issue
• Fixed crash issue with Mac version 10.6
• Fixed plugins installation issue (correcting an error in the User Agent)
• Fixed broken images while adding new user in settings page
• Fixed typo issue in the Protected mode message popup
• Permissions fixed to be safer and less permissive

Browser Password Decryptor is the FREE software to instantly recover website login passwords stored by popular web browsers.

Currently it can recover saved login passwords from following browsers.

Firefox Internet Explorer Google Chrome Google Chrome Canary/SXS CoolNovo Browser Opera Browser Apple Safari Comodo Dragon Browser SeaMonkey Browser Flock Browser

For command-line version, check out our new tool - Browser Password Dump. Features: Instantly decrypt and recover stored encrypted passwords from popular web browsers. Right Click Context Menu to quickly copy the password Recover password of any length and complexity. Automatically discovers all supported Applications and recovers all the stored passwords. Sort feature to arrange the recovered passwords in various order to make it easier to search through 100's of entries. Save the recovered password list to HTML/XML/Text file Easier and faster to use with its enhanced user friendly GUI interface. Support for local Installation and uninstallation of the software.    Download Browser Password Decryptor v5.5

Features

• Live HTTP Headers — built-in live headers with a dedicated cache per tab and support for preview extensions
• Sandcat Console — an extensible command line console; Allows you to easily run custom commands and scripts in a loaded page
• Resources tab — allows you to view the page resources, such as JavaScript files and other web files.
• Page Menu extensions — allows you to view details about a page and more.
• Pen-Tester Tools — Sandcat comes with a multitude of pen-test oriented extensions. This includes a Fuzzer, a Script Runner, HTTP & XHR Editors, Request Loader, Request Replay capabilities and more.

Pentesting tools

• Cookies and Cache Viewers
• JavaScript Executor extension — allows you to load and run external JavaScript files
• Lua Executor extension — allows you to load and run external Lua scripts
• Page Menu extensions — allows you to view the page headers, cookies, whois information and more
• Request Editor extension with request loading capabilities
• Request Editor (Low-Level version)
• Request Viewer — allows you to view details about a request or replay a request.
• Ruby Console extension
• Sandcat Tasks (Extensions that run as isolated processes):
  • Fuzzer extensions with multiple modes and support for filters
  • CGI Scanner extension
  • HTTP Brute Force
• Script Runner extension — can execute scripts in a variety of languages
• Tor Button extension — Anonymity for standard browsing
• XHR Editor
• Various Encoders/Decoders, new Sandcat Console commands, security related search engine options, and more

• SQL Injection functions
  • Filter Evasion – Database-Specific String Escape (CHAR & CHR). Conversion of strings to quoted strings, conversion of spaces to comment tags or new lines
  • Filter Evasion (MySQL-Specific) – String Concatenation, Percent Obfuscation & Integer Representation (eg: ’26′ becomes ‘ceil(pi()*pi())*(!!!pi()+true)+ceil(@@version)’, a technique presented by Johannes Dahse).
  • UNION Statement Maker
  • Quick insertion of common injections covering DB2, Informix, Ingres, MySQL, MSSQL, Oracle & PostgreSQL
• File Inclusion functions
  • One-Click Log Poisoning
  • Quick Shell Upload code generator
  • PHP String Escape (chr)
• Cross-Site Scripting (XSS) functions
  • Filter Evasion – JavaScript String Escape (String.fromCharCode), CSS Escape
  • Various handy alert statements for testing for XSS vulnerabilities.
• Hash functions
  • MD5 Hash Crackers – Built-in (offline) and online MD5 hash crackers
  • Hash Generators – MD5, SHA-1, SHA-2 (224, 256, 384 & 512), GOST, HAVAL (various), MD2, MD4, RIPEMD (128, 160, 256 & 320), Salsa10, Salsa20, Snefru (128 & 256), Tiger (various) & WHIRLPOOL
• Encoders/Decoders
  • URL Encoder/Decoder
  • Hex Encoder/Decoder – Converts a string or integer to hexadecimal or vice-versa (multiple output formats supported).
  • Base64 Encoder/Decoder
  • CharCode Converter – Converts a string to charcodes (eg: ‘abc’ becomes ’97,98,99′) or vice-versa.
  • IP Obfuscator – Converts an IP to dword, hex or octal.
  • JavaScript Encoders – Such as JJEncode by Yosuke HASEGAWA
• HTML functions
  • HTML Escape/Unescape
  • HTML Entity Encoder/Decoder – Decimal and hexadecimal HTML entity encoders & decoders
  • JavaScript String Escape
• Text Manipulation functions – Uppercase, Lowercase, Swap Case, Title Case, Reverse, Shuffle, Strip Slashes, Strip Spaces, Add Slashes, Char Separator
• Time-Based Blind Injection code – Covering MySQL, MSSQL, Oracle, PostgreSQL, Server-Side JavaScript & MongoDB
• CRC Calculators – CRC16, CRC32, CRC32b, and more.
• Classical Ciphers – ROT13 & ROT[N]
• Checksum Calculators – Adler-32 & Fletcher
• Buffer Overflow String Creator
• Random String & Number Generation functions
• URL Splitter
• Useful Strings – Math, character sets and more.

Browser Password Dump is the free command-line tool to instantly recover your lost password from all the popular web browsers.

Currently it can recover stored web login passwords from following browsers.

• Firefox
• Internet Explorer
• Google Chrome
• Chrome Canary/SXS
• CoolNovo Browser
• Opera Browser
• Apple Safari
• Flock Browser
• SeaMonkey Browser
• Comodo Dragon Browser

It automatically discovers installed applications on your system and recovers all the stored web login passwords within seconds.

Browser Password Decryptor is the FREE software to instantly recover website login passwords stored by popular web browsers.

Currently it can recover saved login passwords from following browsers.

Firefox Internet Explorer Google Chrome Google Chrome Canary/SXS CoolNovo Browser Opera Browser Apple Safari Comodo Dragon Browser SeaMonkey Browser Flock Browser

It has both GUI interface as well as command line version making it more useful for Penetration testers and Forensic investigators. Download Browser Password Decryptor v5.0

Many times during an examination, we'll take a look at the user's browser activity. That might include starting by getting the contents of the TypedURLs Registry key (I see that as a first step in a lot of analysis plans) and parsing an index.dat file or two; however, one thing that I rarely see in an analysis process, in case notes, or in a report is, the first thing I did was determine the default browser, as well as any other browsers that may have been installed and used.

When exploring user activity via the browser, the analyst needs to be sure to:

1. Check to see what the default browser is...yes, there's an app a RegRipper plugin for that. But keep in mind, this value can change. If the user doesn't uncheck one box in the default browser dialog that appears, they will be asked every time if they want to make the browser their default, so the question will be asked each time and they can go back and forth.

2. Determine what other browsers may be installed; don't assume that someone's only going to use Firefox. Strike that...don't assume anything. Find out. Any easy way to do this is to check the file associations for .htm(l) and .asp(x) files, as well as just see what software is installed.

3. Other places to check (these are included in RegRipper plugins, by the way...) include the user UserAssist keys (what've they been launching), the Uninstall key (for software installations), and which MSIs have been run on the system.

Many of these are quick checks...several folks who've used RegRipper have said that the tool has reduced Registry analysis from days to minutes, and thanks to the plugins, been more comprehensive than previous processes. So adding these checks to your analysis plan doesn't correlate to a significant increase in the time it takes to conduct your analysis.

One area that I rarely see discussed in browser analysis is the bookmarks file. For Firefox, the bookmarks.html file include ADD_DATE and LAST_MODIFIED entries for folders, and ADD_DATE and LAST_VISIT entries for the URLs. For IE, you'd look for the Favorites folder, which contains InternetShortcut/.url files which also include timestamps, in addition to the file MAC times themselves.

It seems to me that including this information in a timeline...should the investigation necessitate doing so...might be a source of some valuable data. For example, let's say you found an entry of interest in the user's Internet history; would it add some additional (and perhaps significant) context to the overall investigation to know that the web site was in the user's bookmarks/Favorites?

Commercial tools like ProDiscover make it very easy to populate the IE Internet History view from an image rather than just a single user. But keep in mind that it isn't IE that populates the Internet history artifacts for the user; it's the use of the WinInet APIs. What that means is that any application or tool that uses the WinInet APIs may leave similar artifacts, which is why, during some engagements, some of us have seen an Internet history for the Default User populated. In one particular instance, wget.exe was found to have been launched using System-level privileges, and the tool was found to use the WinInet APIs so we found clear artifacts of the use in the Default User's Internet history. In that particular case, the intruder used SQL injection to gain access to the MS SQL Server, and ran commands to create an FTP script file, which was then launched via ftp.exe. The script downloaded wget.exe, which the intruder verified was on the system, and then used to download additional software.

Another aspect of browser analysis (specifically for IE) is to look for Browser Helper Objects, or "BHOs". From a forensic analysis perspective, some BHOs have been known to be spyware, or worse; Symantec identified BHOs as a common loading point for malware.

This article discusses how to prevent BHOs from loading with the Explorer process, and only loading with IE.

On Firefox, Add-ons may be of interest. Here's a Symantec article that talks about BHOs (IE) and XPCOM (Mozilla).

My point is that sometimes just looking at the user's Internet browsing history may not be enough to really get a solid picture of what's going on. The existence of a particular web site that has been bookmarked or added to the user's Favorites may add valuable context to the examination. BHOs are loaded when the user starts IE, so any action taken by the BHO will be done in the user's context, and therefore will populate the user's Internet history.

So how might you use this in a real-world investigation? Well, if the user has their browser configured to delete the history when the browser is closed, or uses another tool to do so, you may find something of value in the bookmarks. Even if the history hasn't been deleted, you will be able to associate some artifacts with specific user activity.

What about the Trojan Defense? Well, with a comprehensive and thorough malware detection process, you might also include a specific check for BHOs or addons to the browser, further closing the door on that issue.

Resources
Firefox 3 Forensics
FoxAnalysis
Firefox Forensics (Machor Software - also Windows and Google Chrome Forensics)
NirSoft Browser Tools
WBF Tool

Addendum, 8 Jan
Opera Files - global history is kept in global.dat, entries have a format that looks similar to IE Favorites .url files:

Webpage Title - Something
http(s)://www.somewebsite.com/page
(possible *nix epoch timestamp)

There are a number of times where an analyst would need to know a bit about a user's web browsing activities in order to determine what was happening on a system; was the user in violation of acceptable use policies, or did the user go someplace that ended up getting the system infected, etc? Sometimes this is how systems initially get infected.

There are two excellent articles from Jones and Belani (published on SecurityFocus here and here) that, while a little more than 3 yrs old, are excellent sources of information and a great way to begin understanding what is available via browser forensics, and how to go about collecting information.

One of the things I tend to do when setting up an examination is to open the image in a ProDiscover project, and populate the Internet History Viewer. With PDIR v5.0, this is smoother than with previous versions, and it gives me a quick overview of the browser activity on the system. However, you don't need commercial tools to do this kind of analysis...there are tools out there that you can use either against live systems, or by mounting an image as a read-only file system.

At this point, what you look for is totally up to you. Many times when performing analysis, I have a timeframe in mind, based on information I received from the customer about the date and time of the incident. Other times, I may start with Registry analysis and have some key LastWrite times to work with. In several examinations, I had user profile creation dates, so I used that as my search criteria...locate anything useful that occurred prior to the profile creation date (which, by the way, I correlated with data extracted from the SAM file using RegRipper!!).

Don't forget this little tidbit about web history located for the Default User from Rob "van" Hensing's blog. I used to see this in the SQL injection exams, where the intruder would dump wget.exe on a system, and then use that to pull down his other tools. Wget.exe would use the WinInet APIs to do its work, which would end up as "browser history"...and because the intruder was running as System-level privileges, the history would end up in the Default User account. More recently, I've seen write-ups for malware that use a "hidden" IE window...running at System privileges will leave these same artifacts.

Tools and Resources:
Mork file format
mork.pl - Perl script for parsing the Mork file format
NirSoft.net browser tools
Mandiant WebHistorian
FoxAnalysis - FireFox 3 browser artifact analysis
CacheBack 2.0 - Internet browser cache and history analysis (commercial)
FireFox Forensics (F3) - Forensic artifact analysis tool for FireFox
Historian - Converts browser history files to .csv...also does LNK and INFO2 files
OperaCacheView - Thanks for the link, Claus!

Sometimes I have to marvel at the little pearls (as opposed to Perl!!) I find through sites like eEvidence...Christina's diligence in ensuring that there is always new information added to the site really makes it worthwhile to stop by at least once a month and see what's new.

One of the items I really enjoyed was Hal Berghel's article on BRAP Forensics. In this article, Hal talks about some of the nice little bits of debris or (in his words) "guano" left behind by browsers and applications, as well as OLE file (MS Word) metadata and Recycle Bin/INFO2 file analysis. Hal also mentions Registry analysis, particularly of the NTUSER.DAT file. For the most part, Hal refers to these tidbits in negative terms but for forensic analysts working on an examination, these tidbits can be priceless. I've used many of these techniques...sometimes in combination...to extract some extremely useful information from an examination.

Resources
Mandiant's WebHistorian