Skip to content

add mozdmp: Firefox profile decryption tool and master password cracker #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
asaix wants to merge 1 commit into
base: main
Choose a base branch
from
Open

add mozdmp: Firefox profile decryption tool and master password cracker #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,7 @@ Some of the tools may be specifically designed for red teaming, while others are
</details>

<details open>
<summary><b>Credential Access</b> 11 tools</summary>
<summary><b>Credential Access</b> 12 tools</summary>
<ul>
<ul>
<li><b><a href="#mimikatz">Mimikatz</a></b><i> Windows credential extractor</i></li>
Expand All @@ -202,6 +202,7 @@ Some of the tools may be specifically designed for red teaming, while others are
<li><b><a href="#mailsniper">MailSniper</a></b><i> Microsoft Exchange Mail Searcher</i></li>
<li><b><a href="#sharpchromium">SharpChromium</a></b><i> Cookie, history and saved login chromium extractor</i></li>
<li><b><a href="#dploot">dploot</a></b><i> DPAPI looting remotely in Python</i></li>
<li><b><a href="#mozdmp">mozdmp</a></b><i> Decrypt firefox profile data offline and crack the master password.</i></li>
</ul>
</ul>
</details>
Expand Down Expand Up @@ -3398,6 +3399,34 @@ dploot backupkey -d waza.local -u Administrator -p 'Password!123' 192.168.56.112
dploot certificates -d waza.local -u Administrator -p 'Password!123' 192.168.56.14 -pvk key.pvk -quiet
```

### [🔙](#tool-list)[mozdmp](https://github.com/asaix/mozdmp)

mozdmp is an offline profile decryption tool for the Mozilla Firefox browser. It decrypts the `logins.json` file that stores saved user passwords by extracting the key from the NSS database (`key4.db`).

Unlike Chromium-based browsers which protect their sensitive files with OS-level tooling (keyrings, DPAPI), Firefox stores everything needed to decrypt saved logins within the profile itself. Given a copy of `key4.db` and `logins.json`, mozdmp recovers the plaintext credentials without needing anything else from the host.

- Supports the latest Firefox versions, which use SHA384 to derive the PBKDF2 input (the correct hash type is selected automatically).
- **Cracks a user-set master password with a wordlist**. Multi-core cracking is supported on Linux; on Windows/macOS cracking runs single-core.

**Install:**

Download and extract the latest [binary release](https://github.com/asaix/mozdmp/releases) (Linux only). To run on Windows/macOS, clone the source and install the dependencies:

```bash
git clone https://github.com/asaix/mozdmp; cd mozdmp
pip install -r requirements.txt
```

**Usage:**

```bash
# Binary release
mozdmp <key4db> <logins_json>

# From source
python3 mozdmp.py <key4db> <logins_json>
```

Discovery
====================

Expand Down