Internet History Browser Tool

[Guest]

Is there a way (custom tool) that I could remotely quickly view the index.dat and internet history in a readable format that would show date time and website visited for a machine? I am hoping someone else has done the leg work for this, if not I will start on something. I have proxy logs but it takes forever when you have 8000 users to parse. If I could just do a quick scan on a computer, it would tell me if I should do a more in depth investigation. If I spot something while scanning the network packets or someone reports activity, then I want to quickly scan that computer. Currently I can explore the drive and browse to open the index.dat in notepad, But man there has to be something better. Thanks in advance. I will start to work immediately on a tool if someone doesn't report they have an easy solution.

[UKTonyK]

Re: Internet History Browser Tool

Interesting concept, and one I could use myself. There is a utility called IEHV.exe which is a standalone tool that extracts out Internet History, maybe linking that in with psexec's cmd function might work.

You've got me thinking now.

[Guest]

Re: Internet History Browser Tool

UKTonyK,
Thanks man that is exactly what I was looking for. Here is the script I used to make it work. Make sure you put in an administrators username and password in where needed(this can be for the local machine)Notice below that I have mapped my tools folder on my server to X:\ so just change that path to your PStools path. Also I made a folder called iehv and copied that iehv executable to that folder and pointed to it. This is setup to create the text log on the local machines c: drive in a folder called temp. I hope this helps anyone who needs it. If I can help let me know. The tool script below when ran against a machine in your hyena list will bring up the internet history in a list in dos (unless they have deleted it)

CMD.exe /x /c x:\tech\hyena\tools\pstools\psexec.exe -u domain\admin -p adminpassword \\%E% x:\tech\hyena\tools\iehv\iehv.exe /stabular "c:\temp\urls.txt" & Type \\%E%\c$\temp\urls.txt & pause

[UKTonyK]

Re: Internet History Browser Tool

Nice work.

Issue I have got is that we use roaming profiles here and if I run IEHV remotely with credentials it appears to try and lift the IEH from the connecting user id rather than the actual logged on user. As my coding skills are about absolutely bugger all, how would I go about referring to current locally logged on user or pulling the user id from the description field ( we populate last person logged on in the description field of the computer.