The LaZagne Project - Recover most common software passwords (Firefox, IE, Opera, Chrome, Filezilla, winscp, coreFTP, WiFi and many more)

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different technics (plaintext, using api, custom algorithms, etc.). This tool has been developped to find these passwords for most common softwares. At this moment, it supports 22 softwares on windows and 12 on a linux plateform.

Usage

• Launch all modules
  
  • cmd: laZagne.exe all
• Launch only a specific module
  
  • cmd: laZagne.exe
  • example: laZagne.exe browsers
  • help: laZagne.exe -h
• Launch only a specific software script
  
  • cmd: laZagne.exe
  • example: laZagne.exe browsers -f
  • help: laZagne.exe browsers -h
• Write all passwords found into a file (-w options)
  
  • cmd: laZagne.exe all -w

Supported softwares

• Windows (tested on Windows XP, 7 and 8 - 32 and 64 bits)
  
  • browsers
    
    • firefox
    • chrome
    • opera
    • ie
  • chats
    
    • skype
    • pidgin
    • jitsi
  • mails
    
    • thunderbird
    • outlook
  • adminsys
    
    • filezilla
    • puttycm
    • winscp
    • cyberduck
    • coreFTP
    • FTPNavigator
  • database
    
    • sqldeveloper
    • squirrel
    • dbvisualizer
  • svn
    
    • tortoise
  • wifi
    
    • Wireless Network Password (Windows mechanism)
  • windows credentials
    
    • Domain visible network (.Net Passport)
    • Generic network credentials
• Linux
  
  • browsers
    
    • firefox
    • opera
  • chats
    
    • pidgin
    • jitsi
  • mails
    
    • thunderbird
  • adminsys
    
    • filezilla
    • environment variables
  • database
    
    • sqldeveloper
    • squirrel
    • dbvisualizer
  • wifi
    
    • network manager
  • wallet
    
    • gnome keyring

IE Browser history

Internet Explorer passwords (from ie7 and before windows 8) can only be decrypted using the URL of the website. This one is used as an argument of the Win32CryptUnprotectData api. So to decrypt it, it is necessary to retreive the browser history of ie. To do that, I have used C code. So I used a dll (the code is on on the "browser_history_dll" directory) and it is directly embedded to the python code as a base64 string (c.f. ie.py). Once launched, the dll is written to the disk, a wrapper is used to call dll functions and then the dll file is removed from the disk.

Build your own password recovery script

It is possible to write your own script for the software of your choice.

To do that, some syntax requirements are needed:

• Create a class using the name of the software
• This class has to have a function called "retrieve_password" (it will be the main function)
• The output containing all passwords has to be send to the "print_output" function - ex: print_output(, password_list)
  • password_list has to be an array of dictionnaries.
• Optional: you could use the function "print_debug" to print your output
  • ex: print_debug("ERROR", "Failed to load ...")
• Use an existing script to understand what I have said :)

If you want to improve this tool, you could send me your script and it will be added to this project (authors will be of course credited on each script ;)).

Requirements

To compile the source code, some external library are required.

• For Windows
  
  • Wconio (for the color)
    
    • http://newcenturycomputers.net/projects/wconio.html
    • http://newcenturycomputers.net/projects/download.cgi/WConio-1.5.win32-py2.7.exe
  • Python for Windows Extensions
    
    • http://sourceforge.net/projects/pywin32/
• For Linux
  • None

Download The LaZagne Project

Read More

[ImageCacheViewer] View images in the cache of your Web browser

ImageCacheViewer is a simple tool that scans the cache of your Web browser (Internet Explorer, Firefox, or Chrome), and lists the images displayed in the Web sites that you recently visited. 

For every cached image file, the following information is displayed: URL of the image, Web browser that was used to visit the page, image type, date/time of the image, browsing time, and file size. 

When selecting a cache item in the upper pane of ImageCacheViewer, the image is displayed in the lower pane, and you can copy the image to the clipboard by pressing Ctrl+M.

System Requirements And Limitations

• This utility works in any version of Windows, starting from Windows XP and up to Windows 8. Both 32-bit and 64-bit systems are supported.
• The following Web browsers are supported: Internet Explorer, Mozilla Firefox, SeaMonkey, and Google Chrome.
• ImageCacheViewer won't work if you configure your Web browser to clear the cache after closing it.
• It's recommended to close all windows of your Web browser before using ImageCacheViewer, to ensure that all cache files are saved to the disk.

Start Using ImageCacheViewer

ImageCacheViewer doesn't require any installation process or additional DLL files. In order to start using it, simply run the executable file - ImageCacheViewer.exe

After running ImageCacheViewer, it begins to scan the cache of your Web browser, and displays all cached images from Web sites you visited in the last day. If you want to get images from other days, you can remove or change the last 1-day filter from the 'Advanced Options' window (F9).

After the scanning process is finished, you can also watch the image in the lower pane of ImageCacheViewer, by selecting the desired item in the upper pane.

If from some reason ImageCacheViewer fails to detect the cache of your Web browser properly, you can go to 'Advanced Options' window (F9), and choose the desired cache folders to scan for each Web browser.

Download ImageCacheViewer

Read More

[IE Password Decryptor] Internet Explorer Password Recovery Tool

IE Password Decryptor is the FREE software to quickly and easily recover all the stored passwords from Internet Explorer.

It automatically detects the installed IE version and use appropriate technique to successfully decrypt all the stored passwords.

It can recover passwords from all versions of Internet Explorer starting from version 4.0 to latest version 10.0.

One of the unique feature of this tool is that it can recover passwords (from IE v7-v9) for popular websites without depending on the history.

It also presents 'IE History Manager' interface which not only displays the contents of IE history in detail but also provides the option to add/remove websites with ease.

This single tool comes with both GUI as well as command-line interface making it useful for pen testers as well as forensic investigators.

It works on both 32-bit & 64-bit platforms starting from Windows XP to Windows 8.

Download IE Password Decryptor

Read More