火狐数据库

places.sqlite

书签

moz_bookmarks: This table contains bookmarks, folders, separators and tags, and defines the hierarchy. The hierarchy is defined via the parent column, which points to the moz_bookmarks record which is the parent. The position column numbers each of the peers beneath a given parent starting with 0 and incrementing higher with each addition. The fk column provides the id number of the corresponding record in moz_places.
moz_bookmarks_roots: Lists special folders that are the root folders of certain content types in the bookmarks system. The records in this table are mapped to records in the moz_bookmarks table. Bookmarks, folders and separators are descendants of the bookmarks root, while tags and tagged URIs are descendants of the tag root.
moz_keywords: This table is a unique list of keywords. The moz_bookmarks table has a keyword_id column that maps to a record in moz_keywords table.^[1]

标签查询

-- 4 是 type 为 2、title 为“书签”的项
-- 所有标签
SELECT * FROM moz_bookmarks WHERE parent = 4;
-- 所有打上了 paste 标签的条目
SELECT * FROM moz_places WHERE id in (
  SELECT fk FROM moz_bookmarks WHERE parent in (
    SELECT id FROM moz_bookmarks WHERE parent = 4 and title = 'paste'
  )
);

选取所有小书签的标题和 URL：

select distinct moz_bookmarks.title as title, url
from moz_places, moz_bookmarks
where url like 'javascript:%'
and moz_places.id = moz_bookmarks.fk
and moz_bookmarks.title is not null

关键字搜索信息

select * from moz_bookmarks, moz_keywords where moz_bookmarks.keyword_id = moz_keywords.id;

历史记录

修改历史记录

UPDATE OR REPLACE moz_places SET url = REPLACE(url, '/index.php', '') WHERE url LIKE 'http://localhost/wiki/index.php/%';

使用正则来修改历史记录（使用扩展）

将jar:协议改成直接访问：

select load_extension('./glib_replace.so');
UPDATE OR REPLACE moz_places SET url = regex_replace('^jar:((?:.(?![^/]+\.zip!))+)(/[^/]+)\.zip!(.*)$', url, '\1\2\3') WHERE url LIKE 'jar:file:///home/lilydjwg/%%E6%%96%%87%%E6%%A1%%A3/%%E7%%BC%%96%%E7%%A8%%8B/Python/python%';

将直接访问改成使用jar:协议：

SELECT load_extension('./glib_replace.so');
UPDATE OR REPLACE moz_places SET url = regex_replace('^(file:///home/lilydjwg/%E6%96%87%E6%A1%A3/%E7%BC%96%E7%A8%8B/Python/python[^/]*)(.*)$', url, 'jar:\1.zip!\2') WHERE url LIKE 'file:///home/lilydjwg/%%E6%%96%%87%%E6%%A1%%A3/%%E7%%BC%%96%%E7%%A8%%8B/Python/python%';

moz_place表中的last_visit_date转成日期：

time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(last_visit_date//1000000))))

cookies.sqlite

导出 cookie 为文本文件（可用于 curl、wget）：

sqlite3 -noheader -list -separator $'\t' ~ff/cookies.sqlite 'select host, "TRUE", path, case isSecure when 0 then "FALSE" else "TRUE" end, expiry, name, value from moz_cookies' > cookies.txt

logins.json

已保存的密码（旧为signons.sqlite）。其中的用户名和密码需要使用 NSS 来解密^[2]^[3]。

webappsstore.sqlite

localStorage 数据。

参见

外部链接

参考资料

[1] ttps://developer.mozilla.org/en/The_Places_database#Bookmarks_Tables

[2] GitHub - Unode/firefox_decrypt: Firefox Decrypt is a tool to extract passwords from Firefox profiles

[3] winterpy/firefoxutils.py at master · lilydjwg/winterpy · GitHub

[1]

[2]

[3]