用python调查应用程序结构

用Python调查应用程序结构

SQLite 数据库在几个不同的应用程序中是很流行的选择，对于local/client 存储类型来说。尤其是 WEB 浏览器，因为与编程语言不相关绑定。 与其相对应的 client/server 关系数据库，SQLite 数据库存储整个数据库在主机 上作为单个文件。

了解Skype SQLite3数据库

作为 4.0 版本，流行的聊天工具 Skype 改变了它的内部数据库格式，使用 SQLite 格式。在 Windows 系统中，Skype 存储了的一个名叫 main.db 的数据库 在路径 C:\Documents and Settings\\ApplicationData\Skype\目录下，在 MAC OS X 系统中，相同的数据库放在 /Users//Library/Application\ Support/Skype/目录下。 SQLite 数据库维护了一个表名为sqlite _master，这个表包含了列名为tbl_name，用来描述数据库中的每一个表。执行这句 SELECT 语句允许我们查 看 Skype 的 main.db 数据库中的表。我们可以看到，该数据库保存的表包含电 话，账户，消息甚至是 SMS 消息的信息。

investigator$ sqlite3 main.db SQLite version 3.7.9 2011-11-01 00:52:41 Enter ".help" for instructions Enter SQL statements terminated with a ";" sqlite> SELECT tbl_name FROM sqlite_master WHERE type=="table"; DbMeta Contacts LegacyMessages Calls Accounts Transfers Voicemails Chats Messages ContactGroups Videos SMSes CallMembers ChatMembers Alerts Conversations Participants sqlite> SELECT fullname, skypename, city, country, datetime(profile_timestamp,'unixepoch') FROM accounts; TJ OConnor|<accountname>|New York|us|22010-01-17 16:28:18

使用Python的Sqlite3自动完成Skype数据库查询

利用 sqlite3 库来编写一个小的 Python 程序来完成这些。注意我们的函数 printProfile()，它创建一个到 main.db 数据库的连接，创建一个连接之后，它需要一个光标提示然后执行我们先前的 SELECT 语句，SELECT 语句的结果返回一个包含数组的数组。对于每个返回的结果，它包含用户，Skype 用户名，位置和介绍数据的索引列。

# coding=UTF-8 import sqlite3 def printProfile(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() C.execute("SELECT fullname,skypename,city,country,datatime(profile_timestamp,'unixepoch')FROM Accounts;") for row in c: print('[*] --Found Account--') print('[+] User:' + str(row[0])) print('[+] Skype Username:' + str(row[1])) print('[+] Location:' + str(row[2]) + ',' + str(row[3])) print('[+] Profile Date:' + str(row[4])) def main(): skypeDB = "main.db" printProfile(skypeDB) if __name__ == "__main__": main()

所有这些个人信息当我们调查或者是攻击一个目标时都 是有用的，所以我们将信息收集起来。让我们输出 SELECT 语句返回的信息， 注意几个字段，比如生日可能是 null，在这种情况下，我们利用条件语句只打印不等于空的结果

def printContacts(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute("SELECT displayname, skypename, city, country,phone_mobile, birthday FROM Contacts;") for row in c: print('\n[*] --Found Contact--') print('[+] User:' + str(row[0])) print('[+] Skype Username:' + str(row[1])) if str(row[2]) != '' and str(row[2]) != 'None': print('[+]Location:' + str(row[2]) + ',' + str(row[3])) if str(row[4]) != 'None': print('[+]Mobile Number:' + str(row[4])) if str(row[5]) != 'None': print('[+]Birthday:' + str(row[5]))

直到限制我们只是从特定的表中提取特定的列检查，然而当我们向将两个表中的信息一起输出，需要WHERE x = x来确认，返回包含所有存储在Skype数据库中的Skype的通过记录时间和身份。

def printCallLog(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute(("SELECT datetime(begin_timestamp,'unixepoch'),identity FROM calls, conversations WHERE calls.conv_dbid = conversations.id;")) print('\n[*]--Found Calls--') for row in c: print('[+] Time: ' + str(row[0]) + ' | Partner: ' + str(row[1]))

最后printMessage

def printMessage(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute("SELECT datetime(timestamp,'unixepoch'),dialog_partner, author, body_xml FROM Messages;") print('\n[*]--Found Messages--') for row in c: try: if 'partlist' not in str(row[3]): if str(row[1]) != str(row[2]): msgDirection = 'To' + str(row[1]) + ':' else: msgDirection = 'From' + str(row[2]) + ':' print('Time: ' + str(row[0]) + '' + msgDirection + str(row[3])) except: pass # coding=UTF-8 import sqlite3 import optparse import os def printProfile(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() C.execute("SELECT fullname,skypename,city,country,datatime(profile_timestamp,'unixepoch')FROM Accounts;") for row in c: print('[*] --Found Account--') print('[+] User:' + str(row[0])) print('[+] Skype Username:' + str(row[1])) print('[+] Location:' + str(row[2]) + ',' + str(row[3])) print('[+] Profile Date:' + str(row[4])) def printContacts(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute("SELECT displayname, skypename, city, country,phone_mobile, birthday FROM Contacts;") for row in c: print('\n[*] --Found Contact--') print('[+] User:' + str(row[0])) print('[+] Skype Username:' + str(row[1])) if str(row[2]) != '' and str(row[2]) != 'None': print('[+]Location:' + str(row[2]) + ',' + str(row[3])) if str(row[4]) != 'None': print('[+]Mobile Number:' + str(row[4])) if str(row[5]) != 'None': print('[+]Birthday:' + str(row[5])) def printCallLog(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute(( "SELECT datetime(begin_timestamp,'unixepoch'),identity FROM calls, conversations WHERE calls.conv_dbid = conversations.id;")) print('\n[*]--Found Calls--') for row in c: print('[+] Time: ' + str(row[0]) + ' | Partner: ' + str(row[1])) def printMessage(skypeDB): conn = sqlite3.connect(skypeDB) c = conn.cursor() c.execute("SELECT datetime(timestamp,'unixepoch'),dialog_partner, author, body_xml FROM Messages;") print('\n[*]--Found Messages--') for row in c: try: if 'partlist' not in str(row[3]): if str(row[1]) != str(row[2]): msgDirection = 'To' + str(row[1]) + ':' else: msgDirection = 'From' + str(row[2]) + ':' print('Time: ' + str(row[0]) + '' + msgDirection + str(row[3])) except: pass def main(): parser = optparse.OptionParser("usage%prog -p <skype profile path > ") parser.add_option('-p', dest='pathName', type='string', help='specify skype profile path') (options, args) = parser.parse_args() pathName = options.pathName if pathName == None: print parser.usage exit(0) elif os.path.isdir(pathName) == False: print '[!] Path Does Not Exist:' + pathName exit(0) else: skypeDB = os.path.join(pathName, 'main.db') if os.path.isfile(skypeDB): printProfile(skypeDB) printContacts(skypeDB) printCallLog(skypeDB) printMessages(skypeDB) else: print '[!] Skype Database does not exist:' + skypeDB if __name__ == "__main__": main()

运行该脚本，添加-p选项来确定skype配置数据库路径，脚本打印出存储在目标机器上的账户配置，联系人，电话和消息。

investigator$ python skype-parse.py -p /root/.Skype/not.myaccount [*] -- Found Account -- [+] User : TJ OConnor [+] Skype Username : <accountname> [+] Location : New York, US [+] Profile Date : 2010-01-17 16:28:18 [*] -- Found Contact -- [+] User : Some User [+] Skype Username : some.user [+] Location [+] Mobile Number [+] Birthday : Basking Ridge, NJ,us : +19085555555 : 19750101 [*] -- Found Calls -- [+] Time: xxxx.xx.xx 15:45:20 | Partner: +xxxxxxxxxx

用python解析火狐sqlite3数据库

火狐存储这些数据库的默认路径是：C:\Documents and Settings\\Application Data\Mozilla\Firefox\Profiles\\或者``/Users//Library/Application\ Support/Firefox/Profiles/

┌─[showmeshell@parrot]─[~/.mozilla/firefox/iyGIUuytfv.Parrot] └──╼ $ls *.sqlite content-prefs.sqlite formhistory.sqlite places.sqlite cookies.sqlite kinto.sqlite storage.sqlite favicons.sqlite permissions.sqlite webappsstore.sqlite

download.sqlite文件存储了火狐用户下载文件的信息，包含一个声明为moz_downloads，用来存储文件名，下载源，下载日期，文件大小，存储在本地的位置等信息。

# coding = UTF-8 import sqlite3 import re import optparse import os def printDownloads(downloadDB): conn = sqlite3.connect(downloadDB) c = conn.cursor() c.execute('SELECT name, source, datetime(endTime/1000000,\'unixepoch\') FROM moz_downloads;') print('\n[*]-----Files Downloaded---') for row in c: print('[+] File: ' + str(row[0]) + ' from source: ' + str(row[1]) + ' at: ' + str(row[2])) def printCookie(cookiesDB): try: conn = sqlite3.connect(cookiesDB) c = conn.cursor() c.execute('SELECT host,name,value FROM moz_cookies') print('\n[*] --Found Cookies--') for row in c: host = str(row[0]) name = str(row[1]) value = str(row[2]) print('[+]Host:' + host + ',Cookie:' + name + ',Value:' + value) except Exception as e: if 'encrypted' in str(e): print('\n[*] Error reading your cookies database.') print('[*]Upgrade your Python-Sqlite3 Library') def printHistory(placesDB): try: conn = sqlite3.connect(placesDB) c = conn.cursor() c.execute( "select url, datetime(visit_date/1000000,'unixepoch') from moz_places, moz_historyvisits where visit_count >0 and moz_places.id == moz_historyvisits.place_id;") print('\n[*] --Found History--') for row in c: url = str(row[0]) date = str(row[1]) print('[+]' + date + '-Visited:' + url) except Exception as e: if 'encrypted' in str(e): print('\n[*] Error reading your places database.') print('[*] Upgrade your Python-Sqlite3 Library') exit(0) def printGoogle(placesDB): conn = sqlite3.connect(placesDB) c = conn.cursor() c.execute( "select url, datetime(visit_date/1000000, 'unixepoch') from moz_places, moz_historyvisits where visit_count > 0 and moz_places.id == moz_historyvisits.place_id;") print('\n[*]--Found Google--') for row in c: url = str(row[0]) date = str(row[1]) if 'google' in url.lower(): r = re.findall(r'q=.*\&', url) if r: search = r[0].split('&')[0] search = search.replace('q=,''').replace('+', '') print('[+]' + date + '-Searched For:' + search) def main() parser = optparse.OptionParser("usage%prog -p <firefox profile path > ") parser.add_option('-p', dest='pathName', type='string', help='specify skype profile path') (options, args) = parser.parse_args() pathName = options.pathName if pathName == None: print(parser.usage) exit(0) elif os.path.isdir(pathName) == False: print('[!]Path Does Not Exist:' + pathName) exit(0) else: downloadDB = os.path.join(pathName, 'downloads.sqlite') if os.path.isfile(downloadDB): printDownloads(downloadDB) else: print('[!] DOwnloads DB does not exist: ' + downloadDB) cookiesDB = os.path.join(pathName, 'cookies.sqlite') if os.path.isfile(cookiesDB): printCookie(cookiesDB) else: print('[!] Cookies DB does not exist:' + cookiesDB) placesDB = os.path.join(pathName, 'places.sqlite') if os.path.isfile(placesDB): printHistory(placesDB) printGoogle(placesDB) else: print('[!]PlacesDB dost not exist: ' + placesDB) if __name__ == "__main__": main()

Google 搜索查询包含搜索URL 内部的权限 只提取搜索条件 URL 右边的条目。如果在我们的历史里发现包含 Google，我们发现他的特点 q=后面跟随着&。这个特定的字符序列标识 Google 搜索。如果我们真的找到这个条目，我们将通过用空格替换一些 URL 中 用的字符来清理输出。最后，我们将打印校正后的输出到屏幕上，现在我们有 一个函数可以搜索 places.sqlite 文件并打印 Google 搜索查询历史。

investigator$ python parse-firefox.py -p ∼/Library/Application\ Support/Firefox/Profiles/5ab3jj51.default/ [*] --- Files Downloaded --- [+] File: ANONOPS_The_Press_Release.pdf from source: http://www.wired.com/images_blogs/threatlevel/2010/12/ANON OPS_The_ Press_Release.pdf at: 2011-12-14 05:54:31 [*] -- Found Cookies -- [+] Host: .mozilla.org, Cookie: wtspl, Value: 894880 [+] Host: www.webassessor.com, Cookie: __utma, Value: ...........................

用python调查设备移动的iTunes备份

当用户对 iPhone 或者 iPad 设备进行备份时，它将文件存储到机器的特殊目录。 对于 Windows 系统，iTunes 程序存储移动设备备份目录在 C:\Documents and Settings\\Application Data\AppleComputer\MobileSync\Backup下，在 Mac OS X 系统上储存目录在 /Users//Library/Application Support/MobileSync/Backup/。 iTunes 程序备份移动设备存储所有的移动设备到这些目录下。

使用 Python 脚本快速的快速的枚举在移动备份目录下找到的每 一个数据库的所有的表。 Python 脚本中使用 sqlite3。我们的脚本列出工作目录的内容然后尝试连接每一个数据库。对于那 些成功的连接，脚本将执行命令：SELECT tbl_name FROM sqlite_master WHERE type==‘table’。每一个 SQLite 数据库维护了一个 sqlite_master 的表包含了数据库的总体结构，说明了数据库的总体架构。上面的命令允许我们列举数据库模式。

import os import sqlite3 def printTables(iphoneDB): try: conn=sqlite3.connect(iphoneDB) c=conn.cursor() c.execute('SELECT tbl_name FROM sqlite_master WHERE type ==\"table\";') print("\n[*]Database:"+iphoneDB) for row in c: print("[-]Table:"+str(row)) except: pass finally: conn.close() dirlist=os.listdir(os.getcwd()) for fileName in dirlist: printTables(fileName)

想要能 够自动的对不同的备份进行调查。为了执行这个，我们编写了一个简单的函数 名为 isMessageTable()，这个函数将连接数据库并枚举数据库模式信息。如果 文件包含名为 messages 的表，则返回 True，否则函数返回 False

def isMessageTable(iphoneDB): try: conn=sqlite3.connect(iphoneDB) c=conn.cursor() c.execute('SELECT tbl_name FROM sqlite_master WHERE type ==\"table\";') for row in c: if 'message' in str(row): return True except: return False

望可以打印包含在数据库中的 内容，如时间，地址，文本消息。为此，我们连接数据库并执行以下命令： ‘select datetime(date,\‘unixepoch\’), address, text from message WHERE address>0;’

def printMessage(msgDB): try: conn = sqlite3.connect(msgDB) c = conn.cursor() c.execute('select datetime(date,\'unixepoch\'),address, text from message WHERE address>0;') for row in c: date = str(row[0]) addr = str(row[1]) text = row[2] print('\n[+] Date: ' + date + ', Addr: ' + addr + ' Message: ' + text) except: pass

将添加一个选项解析来 执行 iPhone 备份的目录。接下来，我们将列出该目录的内容并测试每一个文件 直到找到文本信息数据库

import os import sqlite3 import optparse def isMessageTable(iphoneDB): try: conn = sqlite3.connect(iphoneDB) c = conn.cursor() c.execute('SELECT tbl_name FROM sqlite_master WHERE type ==\"table\";') for row in c: if 'message' in str(row): return True except: return False def printMessage(msgDB): try: conn = sqlite3.connect(msgDB) c = conn.cursor() c.execute('select datetime(date,\'unixepoch\'),address, text from message WHERE address>0;') for row in c: date = str(row[0]) addr = str(row[1]) text = row[2] print('\n[+] Date: ' + date + ', Addr: ' + addr + ' Message: ' + text) except: pass def main(): parser = optparse.OptionParser("usage%prog -p <iPhone Backup Directory>") parser.add_option('-p', dest='pathName', type='string', help='specify skype profile path') (options, args) = parser.parse_args() pathName = options.pathName if pathName == None: print parser.usage exit() else: dirlist = os.listdir(pathName) for fileName in dirlist: iphoneDB = os.path.join(pathName, fileName) if isMessageTable(iphoneDB) try: print('\n[*]---FOund Messages--') printMessage(iphoneDB) except: pass if __name__ == '__main__': main()