Havelock

Extract and decrypt accounts, cookies, and history from web browsers based on Chromium. Havelock was initially developed as part of a remote administration tool for harvesting accounts from a computer and sending them to a remote endpoint securely. It’s now available as an API in JavaScript and a standalone CLI.

Verified Web Browsers

Every web browser using the same storage mechanism for user data is supported. These are the verified web browsers:

| Name | API | Platform(s) | | -------------------- | -------------- | --------------------- | | Chromium | chromium | Windows, macOS, Linux | | Google Chrome Stable | chrome | Windows, macOS, Linux | | Google Chrome Beta | chromeBeta | Linux | | Google Chrome Dev | chromeDev | Linux | | Google Chrome Canary | chromeCanary | Windows, macOS | | Brave Stable | brave | Windows, macOS, Linux |

Adding a browser

Feel free to add support for more browsers through a Pull Request. To get started, take a look at the existing browser definitions in /browsers. The gist of adding a browser is simple. You need to figure out the Keychain credentials and provide a path resolution that works on Windows, macOS, and Linux.

String Decryption

You can decrypt strings retrieved from your web browser using Havelock. Currently, there is only support for macOS.

| Platform | Algorithm | Supported | Source | | -------- | ----------- | --------- | ----------------------------------------------------------------------------------------------------------------------- | | Windows | AES-256-GCM | No | os_crypt_win.cc | | macOS | AES-128-CBC | Yes | os_crypt_mac.mm | | Linux | AES-128-CBC | Yes | os_crypt_linux.cc |

API

The Havelock API is available in JavaScript. You can only use it from a Node.js environment.

Installation

Havelock is available as havelock in npm. Use your favorite package manager to install it to your Node.js project:

yarn add havelock

Usage

Using the Havelock API is quick and easy.

Extracting data

Here’s an example of retrieving data from the logins table in the Login Data file of the Default profile in Google Chrome:

const havelock = require("havelock");

const explorer = havelock.explorer;
const browser = havelock.browser;

explorer
  .getDataFromUserDataDirectoryFile(
    browser.chrome,
    "Default",
    "Login Data",
    "logins"
  )
  .then((logins) => {
    console.info(logins);
  })
  .catch((reason) => {
    console.error(reason);
  });

There are also shorthands available for interesting files. You can achieve the same result using this shorter function:

explorer
  .getLoginsFromLoginDataFile(browser.chrome, "Default")
  .then((logins) => {
    console.log(logins);
  })
  .catch((reason) => {
    console.error(reason);
  });

Decrypting data

Havelock can decrypt passwords and credit cards numbers. Here’s an example of decrypting a password from the logins table in the Login Data file of the Default profile of Google Chrome:

const crypto = havelock.crypto;

explorer
  .getDataFromUserDataDirectoryFile(
    browser.chrome,
    "Default",
    "Login Data",
    "logins"
  )
  .then((logins) => {
    logins.forEach((login) => {
      crypto
        .decrypt(browser.chrome, login.password_value)
        .then((value) => {
          console.log(value);
        })
        .catch((reason) => {
          console.error(reason);
        });
    });
  })
  .catch((reason) => {
    console.error(reason);
  });

CLI

Havelock is also available as a standalone CLI. It can be separately to execute commands on the local machine.

Installation

The Havelock CLI can be included by using your favorite package manager to install it globally:

yarn global add havelock

Usage

The command havelock should now be available globally throughout your system. You can see the commands and options with:

havelock --help

Extracting data

You can retrieve your logins from the default profile in Google Chrome with:

havelock logins chrome default

If you want a more filtered version of the output, i.e. interesting data points, you can use the option -t:

havelock logins chrome default -t

Decrypting data

Use the option -d if you want to decrypt fields known to be encrypted.

Attribution

Thank you to David Sheldrick (ds300) for passing on the package name.

License

MIT