Skip to content

Commit

Permalink
Update Favicons.yaml (#2780)
Browse files Browse the repository at this point in the history
Add OSPath as a hidden field to assist with determining user and edge
profile information
  • Loading branch information
randomaccess3 committed Jun 29, 2023
1 parent 17a8595 commit 96950d1
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions artifacts/definitions/Windows/Applications/Edge/Favicons.yaml
@@ -1,6 +1,8 @@
name: Windows.Applications.Edge.Favicons
description: |
Enumerate the users edge favicons.
Enumerate the users Microsoft Edge favicons.
Tested against Chrome as well, replace Microsoft Edge with Google Chrome in the faviconsGlob
Chrome Favicons are stored in the 'Favicons' SQLite database, within
the 'favicons', 'favicon_bitmaps' and 'icon_mapping' tables. Older
Expand All @@ -21,6 +23,7 @@ parameters:
SELECT favicons.id AS ID,
favicon_bitmaps.icon_id AS IconID,
favicon_bitmaps.image_data as _image,
HEX(favicon_bitmaps.image_data) as _image_hex,
datetime( favicon_bitmaps.last_updated / 1000000 + ( strftime( '%s', '1601-01-01' ) ), 'unixepoch', 'localtime' ) AS LastUpdated,
icon_mapping.page_url AS PageURL,
favicons.url AS FaviconURL
Expand Down Expand Up @@ -56,7 +59,7 @@ sources:
SELECT ID, IconID, LastUpdated, PageURL, FaviconURL,
upload(accessor="data",
file=_image,
name=format(format="Image%v.png", args=ID)) AS Image
name=format(format="Image%v.png", args=ID)) AS Image, _image_hex, OSPath as _OSPath
FROM sqlite(
file=OSPath,
query=faviconsQuery)
Expand Down

0 comments on commit 96950d1

Please sign in to comment.