openwall / openwall/john

mozilla2john.py: Add support for key4.db format

Open
#5,160 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

Description

The mozilla2john.py script included with john supports key3.db files but I noticed mozilla has switched to a new scheme and the new file is called key4.db (an SQLite 3.x database).

Steps to reproduce

  • Install for instance Firefox and set a master password (also known as primary password) for saved passwords
  • Find the key4.db file
    • macOS: ~/Library/Application Support/Firefox/Profiles/profile name/key4.db
    • Linux: ~/.mozilla/firefox/profile name/key4.db

I have not investigated if it is possible to extract a hash from this file but if it's possible it could be added to mozilla2john.py or maybe into a separate script.

Hints

This python program imports libnss and checks the master password using that lib. A dive into libnss is needed to investigate what is really happening. A first look suggest to investigate the PK11_CheckUserPassword() function inside libnss. If I find something more out I will add a comment below.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with run/mozilla2john.py and compare its key3.db handling with the key4.db SQLite format described in the issue. Read firefox_decrypt and investigate libnss, especially PK11_CheckUserPassword(), to determine whether a hash can be extracted. Done means key4.db support is added to mozilla2john.py or a separate script, if extraction is feasible.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, sqlite
Domain
databases, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.