internet explorer password | XenArmor https://xenarmor.com Mon, 30 Sep 2019 16:47:42 +0000 en-US hourly 1 https://xenarmor.com/wp-content/uploads/2018/12/favicon-120x120.png internet explorer password | XenArmor https://xenarmor.com 32 32 How to Recover Saved Passwords in Internet Explorer https://xenarmor.com/how-to-recover-saved-passwords-in-internet-explorer/ https://xenarmor.com/how-to-recover-saved-passwords-in-internet-explorer/#comments Mon, 23 Sep 2019 08:59:10 +0000 https://xenarmor.com/?p=14779 This research article exposes the password secrets of Internet Explorer including where all your website login passwords are stored, how it is stored and how to recover it automatically. Internet Explorer Password Secrets Latest version of Internet Explorer (v7.0 & higher) saves all the website login passwords in following Registry location, [IE v7.0 & higher] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Intelliforms\storage2 Here each Registry value corresponds to each of the website login account stored. Also SHA1 hash of the website link is used as name for this Registry value and data contains encrypted username/password. IE encrypts the website username & password using Windows DPAPI (Data Protection API) functions. IE (v7.0 or higher) stores all HTTP Basic authentication (Router/Model login) passwords in Windows Credential Store. Please refer to next sections for decrypting these passwords programmatically as well as automatically (last section). Older version of IE (v4.0 to v6.0) used to store all the website passwords in Protected Storage at following Registry location, [IE v4.0 to 6.0] HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider The actual contents of this registry location are encrypted and not visible even in Windows Registry Editor. Please refer to next section on how to decrypt these passwords programmatically and automatically. Recover Old IE Version Passwords IE older version uses Protected Storage to store website login passwords. To recover the passwords, we can use Windows functions like PStoreCreateInstance, EnumItems, ReadItem etc. to go through each of the website logins and recover the username & passwords as shown in sample c++ program below. #import "pstorec.dll" no_namespace void ListIEProtectedStorageSecrets() { IPStorePtr PStore; IEnumPStoreTypesPtr EnumPStoreTypes; GUID TypeGUID; char strSiteUrl[1024]; char strSiteCredentials[1024]; char szItemGUID[1024]; char strUsername[1024]; char strPassword[1024]; HRESULT hRes = PStoreCreateInstance(&PStore, 0, 0, 0); hRes = PStore->EnumTypes(0, 0, &EnumPStoreTypes); while( EnumPStoreTypes->raw_Next(1, &TypeGUID, 0) == S_OK ) { sprintf_s(szItemGUID, 1024, "%x", TypeGUID); IEnumPStoreTypesPtr EnumSubTypes; hRes = PStore->EnumSubtypes(0, &TypeGUID, 0,...

Continue Reading

The post How to Recover Saved Passwords in Internet Explorer first appeared on XenArmor.]]> https://xenarmor.com/how-to-recover-saved-passwords-in-internet-explorer/feed/ 1