← Back to Writeups
CUSTOMEasyForensics
Bookmark

Огненная лиса (Fire Fox)

XESXOR9/2/20262 min read
#forensics#custom#easy#firefox_profile_analysis#nss_decryption#password_decryption#linux

Огненная лиса (Fire Fox)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: firefox_profile_analysis, nss_decryption, password_decryption

Summary

Task: Firefox profile with saved passwords. Solution: Used firefox_decrypt.py to decrypt logins.json using key4.db, revealing the flag in the password field.

Огненная лиса (Fire Fox) - HackerLab

Description

Страх любого безопасника...

Provided file: fire_fox.zip

Analysis

The task name "Огненная лиса" (Fire Fox) is a direct reference to the Mozilla Firefox browser. The description "Fear of any security specialist" hints at one of the main security issues - saved passwords in the browser.

Extracting the Archive

 bash 
unzip fire_fox.zip

The archive contains a Firefox profile directory with a standard structure:

profile/
├── logins.json          # Encrypted saved passwords
├── key4.db              # Encryption key database (NSS)
├── cert9.db             # Certificates
├── cookies.sqlite       # Cookies
├── places.sqlite        # Browsing history and bookmarks
├── formhistory.sqlite   # Form history
└── ...                  # Other profile files

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analyzing logins.json

The logins.json file contains encrypted credentials for three websites:

 json 
{
  "logins": [
    {"hostname": "https://hackerlab.pro", ...},
    {"hostname": "https://codeby.net", ...},
    {"hostname": "https://codeby.school", ...}
  ]
}

The encryptedUsername and encryptedPassword fields contain data encrypted using Firefox's NSS (Network Security Services) library.

Key Files

  • logins.json - contains encrypted logins and passwords
  • key4.db - SQLite database with the master key for decryption (if no master password is set, decryption is trivial) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

To decrypt Firefox saved passwords, we use the firefox_decrypt tool:

 bash 
# Clone the tool
git clone https://github.com/unode/firefox_decrypt.git

# Run decryption
python3 firefox_decrypt.py profile/

Decryption Result

Website:   https://hackerlab.pro
Username: 'for3ns1c_task@codeby.net'
Password: 'CODEBY{REDACTED}'

Website:   https://codeby.net
Username: 'user'
Password: 'password123'

Website:   https://codeby.school
Username: 'student@codeby.school'
Password: 'mypassword'

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The flag is in the password for the hackerlab.pro website.

Theory

Firefox stores saved passwords in the logins.json file, encrypted using 3DES-CBC. The encryption key is stored in the key4.db database (or key3.db in older versions). If the user has not set a master password, decryption is possible without additional data.

Useful Tools

  • firefox_decrypt - Python script for decryption
  • LaZagne - universal password extraction tool
  • Firepwd - alternative decryptor ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

References