Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Browser history with powershell

I`m trying to create a script that will retrieve all my browser history, the problem is that I cant make it work with the exact link and the date-time that the website was visited.

Can anyone help me here?

I have already tried this page, but still can`t get Date-Time/ complete link information.

Export Chrome History with Powershell

function Get-ChromeHistory {
            $Path = "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History"
            if (-not (Test-Path -Path $Path)) {
                Write-Verbose "[!] Could not find Chrome History for username: $UserName"
            }
            $Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
            $Value = Get-Content -Path "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History"|Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
            $Value | ForEach-Object {
                $Key = $_
                if ($Key -match $Search){
                    New-Object -TypeName PSObject -Property @{
                        User = $UserName
                        Browser = 'Chrome'
                        DataType = 'History'
                        Data = $_
                    }
                }
            }        
        }

Actual result: Chrome | myusername | https://www.stackoverflow.com/

Expected result: Chrome | username | 06/21/2019 11:05 | https://stackoverflow.com/questions/ask

like image 779
zaibil Avatar asked Mar 02 '26 11:03

zaibil


1 Answers

In addition to the SQLLite Parsing problem, the code above has two bugs: $UserName is not specified and the regex only finds HTTP URLs. Below is a corrected version that gets both HTTP and HTTPS top-level URLs. Unfortunately it does not include the resource path, which you seemed to want but is not possible to get reliably from the SQLLite file. There's no delimiter for the end of a URL in the file.

function Get-ChromeHistory {
    $Path = "$Env:SystemDrive\Users\$Env:USERNAME\AppData\Local\Google\Chrome\User Data\Default\History"
    if (-not (Test-Path -Path $Path)) {
        Write-Verbose "[!] Could not find Chrome History for username: $UserName"
    }
    $Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
    $Value = Get-Content -Path $path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
    $Value | ForEach-Object {
        $Key = $_
        if ($Key -match $Search){
            New-Object -TypeName PSObject -Property @{
                User = $env:UserName
                Browser = 'Chrome'
                DataType = 'History'
                Data = $_
            }
        }
    } 
}
like image 75
Rich Moss Avatar answered Mar 04 '26 22:03

Rich Moss



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!