saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/extracting-browser-history-artifacts/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.1 KiB
Raw Blame History

API Reference: Browser History Extraction Agent

Dependencies

Library Version Purpose
sqlite3 stdlib Query Chrome/Firefox SQLite databases
csv stdlib Export results to CSV format

CLI Usage

python scripts/agent.py \
  --chrome-dir "/mnt/evidence/Users/suspect/AppData/Local/Google/Chrome/User Data/Default" \
  --firefox-dir "/mnt/evidence/Users/suspect/AppData/Roaming/Mozilla/Firefox/Profiles/abc.default" \
  --output-dir /cases/analysis/ \
  --output browser_report.json

Functions

chrome_time_to_utc(chrome_ts) -> str

Converts Chrome/WebKit timestamp (microseconds since 1601-01-01) to ISO-8601 UTC string.

firefox_time_to_utc(ff_ts) -> str

Converts Firefox timestamp (microseconds since Unix epoch) to ISO-8601 UTC string.

extract_chrome_history(db_path, limit) -> list

Queries the urls table from Chrome's History SQLite DB. Returns URL, title, last_visit, visit_count.

extract_chrome_downloads(db_path, limit) -> list

Queries the downloads table for file path, source URL, size, timestamps, and danger type.

extract_chrome_cookies(db_path, limit) -> list

Queries the cookies table. Note: cookie values are DPAPI-encrypted on Windows.

extract_firefox_history(db_path, limit) -> list

Queries moz_places JOIN moz_historyvisits from Firefox places.sqlite.

extract_firefox_cookies(db_path, limit) -> list

Queries moz_cookies from Firefox cookies.sqlite.

export_to_csv(data, output_path)

Writes list of dicts to CSV with headers.

generate_report(chrome_dir, firefox_dir, output_dir) -> dict

Orchestrates extraction from both browsers and exports CSVs.

Browser Database Locations (Windows)

Browser Path
Chrome %LOCALAPPDATA%\Google\Chrome\User Data\Default\History
Edge %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History
Firefox %APPDATA%\Mozilla\Firefox\Profiles\*.default\places.sqlite

Timestamp Formats

Browser Epoch Unit
Chrome/Edge 1601-01-01 Microseconds
Firefox 1970-01-01 Microseconds