utils

Documentation

Index

• Constants
• Variables
• func Btoi(value bool) int
• func FileExists(filename string) bool
• func GetChromeBrowserName(t ChromeBrowserType) string
• func GetChromePathSuffixMap() map[ChromeBrowserType]string
• type ChromeBrowserType
• type ChromeProfilePath
  • func GetChromeProfilePathList() ([]ChromeProfilePath, error)
• type FindFileOpt
  • func WithUsername(username string) FindFileOpt
• type MockOsqueryClient
  • func (m *MockOsqueryClient) Close()
  • func (m *MockOsqueryClient) QueryRow(query string) (map[string]string, error)
  • func (m *MockOsqueryClient) QueryRows(query string) ([]map[string]string, error)
• type MockOsqueryClienter
  • func (m *MockOsqueryClienter) NewOsqueryClient() (OsqueryClient, error)
• type OsqueryClient
• type OsqueryClienter
• type SocketOsqueryClienter
  • func (s *SocketOsqueryClienter) NewOsqueryClient() (OsqueryClient, error)
• type UserFileInfo
  • func FindFileInUserDirs(pattern string, opts ...FindFileOpt) ([]UserFileInfo, error)

Constants

const ProfilePreferencesFile = "Preferences"

Preferences file included in each profile

const SecureProfilePreferencesFile = "Secure Preferences"

Alternative 'Secure Preferences' file included in each profile

Variables

var ChromeBrowserTypeToString = map[ChromeBrowserType]string{
	GoogleChrome:       "chrome",
	GoogleChromeBeta:   "chrome_beta",
	GoogleChromeDev:    "chrome_dev",
	GoogleChromeCanary: "chrome_canary",
	Brave:              "brave",
	Chromium:           "chromium",
	Yandex:             "yandex",
	Opera:              "opera",
	Edge:               "edge",
	EdgeBeta:           "edge_beta",
	Vivaldi:            "vivaldi",
	Arc:                "arc",
}

ChromeBrowserTypeToString maps browser types to their string representations

var HomeDirLocations = map[string][]string{
	"windows": {"/Users"},
	"darwin":  {"/Users"},
	"linux":   {"/home/"},
}

var LinuxPathList = map[ChromeBrowserType]string{
	GoogleChrome:     ".config/google-chrome",
	GoogleChromeBeta: ".config/google-chrome-beta",
	GoogleChromeDev:  ".config/google-chrome-unstable",
	Brave:            ".config/BraveSoftware/Brave-Browser",
	Chromium:         ".config/chromium",
	Yandex:           ".config/yandex-browser-beta",
	Opera:            ".config/opera",
	Vivaldi:          ".config/vivaldi",
}

LinuxPathList maps browser types to their Linux installation paths

var MacOSPathList = map[ChromeBrowserType]string{
	GoogleChrome:       "Library/Application Support/Google/Chrome",
	GoogleChromeBeta:   "Library/Application Support/Google/Chrome Beta",
	GoogleChromeDev:    "Library/Application Support/Google/Chrome Dev",
	GoogleChromeCanary: "Library/Application Support/Google/Chrome Canary",
	Brave:              "Library/Application Support/BraveSoftware/Brave-Browser",
	Chromium:           "Library/Application Support/Chromium",
	Yandex:             "Library/Application Support/Yandex/YandexBrowser",
	Edge:               "Library/Application Support/Microsoft Edge",
	EdgeBeta:           "Library/Application Support/Microsoft Edge Beta",
	Opera:              "Library/Application Support/com.operasoftware.Opera",
	Vivaldi:            "Library/Application Support/Vivaldi",
	Arc:                "Library/Application Support/Arc/User Data",
}

MacOSPathList maps browser types to their macOS installation paths

var WindowsPathList = map[ChromeBrowserType]string{
	GoogleChrome:       "AppData\\Local\\Google\\Chrome\\User Data",
	GoogleChromeBeta:   "AppData\\Local\\Google\\Chrome Beta\\User Data",
	GoogleChromeDev:    "AppData\\Local\\Google\\Chrome Dev\\User Data",
	GoogleChromeCanary: "AppData\\Local\\Google\\Chrome SxS\\User Data",
	Brave:              "AppData\\Roaming\\brave",
	Chromium:           "AppData\\Local\\Chromium",
	Yandex:             "AppData\\Local\\Yandex\\YandexBrowser\\User Data",
	Edge:               "AppData\\Local\\Microsoft\\Edge\\User Data",
	EdgeBeta:           "AppData\\Local\\Microsoft\\Edge Beta\\User Data",
	Opera:              "AppData\\Roaming\\Opera Software\\Opera Stable",
	Vivaldi:            "AppData\\Local\\Vivaldi\\User Data",
}

WindowsPathList maps browser types to their Windows installation paths

Functions

func Btoi

func Btoi(value bool) int

func FileExists

func FileExists(filename string) bool

func GetChromeBrowserName

func GetChromeBrowserName(t ChromeBrowserType) string

GetChromeBrowserName returns the string representation of a ChromeBrowserType

func GetChromePathSuffixMap

func GetChromePathSuffixMap() map[ChromeBrowserType]string

GetChromePathSuffixMap returns the appropriate path list based on the operating system

Types

type ChromeBrowserType

type ChromeBrowserType int

ChromeBrowserType represents different types of Chrome-based browsers

const (
	GoogleChrome ChromeBrowserType = iota
	GoogleChromeBeta
	GoogleChromeDev
	GoogleChromeCanary
	Brave
	Chromium
	Yandex
	Edge
	EdgeBeta
	Opera
	Vivaldi
	Arc
)

type ChromeProfilePath

type ChromeProfilePath struct {
	UserName string
	Type     ChromeBrowserType
	Value    string
}

ChromeProfilePath represents a Chrome profile path with user and browser type information

func GetChromeProfilePathList

func GetChromeProfilePathList() ([]ChromeProfilePath, error)

GetChromeProfilePathList attempts to discover valid Chrome profiles based on user information and known Chrome installation paths.

type FindFileOpt

type FindFileOpt func(*findFile)

func WithUsername

func WithUsername(username string) FindFileOpt

type MockOsqueryClient

type MockOsqueryClient struct {
	Data map[string][]map[string]string
}

func (*MockOsqueryClient) Close

func (m *MockOsqueryClient) Close()

func (*MockOsqueryClient) QueryRow

func (m *MockOsqueryClient) QueryRow(query string) (map[string]string, error)

func (*MockOsqueryClient) QueryRows

func (m *MockOsqueryClient) QueryRows(query string) ([]map[string]string, error)

type MockOsqueryClienter

type MockOsqueryClienter struct {
	Data map[string][]map[string]string
}

func (*MockOsqueryClienter) NewOsqueryClient

func (m *MockOsqueryClienter) NewOsqueryClient() (OsqueryClient, error)

type OsqueryClient

type OsqueryClient interface {
	QueryRows(query string) ([]map[string]string, error)
	QueryRow(query string) (map[string]string, error)
	Close()
}

type OsqueryClienter

type OsqueryClienter interface {
	NewOsqueryClient() (OsqueryClient, error)
}

type SocketOsqueryClienter

type SocketOsqueryClienter struct {
	SocketPath string
	Timeout    time.Duration
}

func (*SocketOsqueryClienter) NewOsqueryClient

func (s *SocketOsqueryClienter) NewOsqueryClient() (OsqueryClient, error)

type UserFileInfo

type UserFileInfo struct {
	User string
	Path string
}

func FindFileInUserDirs

func FindFileInUserDirs(pattern string, opts ...FindFileOpt) ([]UserFileInfo, error)

findFileInUserDirs looks for the existence of a specified path as a subdirectory of users' home directories. It does this by searching likely paths