I'm trying to learn about password decryption by implementing a simple tool to extract encrypted Firefox passwords. I've created a Python program that searches the filesystem for the logins.json file and key4.db database, following similar implementations like this existing project on GitHub. My goal is purely educational; I'm not interested in using this tool for malicious purposes. Instead, I'd like to understand the underlying mechanisms of password encryption and decryption. If I wanted to do something illegal I would just have used the program on GitHub that I mentioned earlier. I am saying this because on other forums some people didn't want to help me. Here's a high-level overview of my program: It finds the logins.json file and extracts encrypted passwords into a list. It connects to the key4.db database and takes some of the data in it and puts it in a dictionary. Some of the important data like item1, item2 and a11 field. I have found online that these are the things that I need. However, when examining the database contents, I'm struggling to comprehend what constitutes the "key" used for decryption. I'm aware that salt values are involved, but I couldn't findsufficient online resources to clarify this aspect. Can anyone help me understand how to decrypt these Firefox passwords using Python? What's the correct approach to working with the encrypted data and identifying the key? Continue reading...
