sekirkity / BrowserGather

Fileless web browser information extraction
MIT License
221 stars 56 forks source link

Error: Number of users is different than the number of passwords #3

Open drale2k opened 7 years ago

drale2k commented 7 years ago

Hi,

i get this error every time i run the script "The number of users is different than the number of passwords! This is most likely due to a regex mismatch".

I ma running Win7 in a VM with only 1 User on the system and latest Google Chrome. I ran the script in 32bit powershell.

What is the issue here?

sekirkity commented 7 years ago

Hi there, the most likely cause for this issue is that the regex I use to try and parse out the credential information didn't manage to capture either the username or the credential information. When that happens, the total number of usernames and passwords have different counts, and therefore are no longer paired to one another. This means that you might see a password for a different username in the results. Unfortunately this method is prone to regex mismatches, despite my best efforts to try and make it as accurate as possible. You could try to open up the sqlite database yourself with a Nirsoft utility, open a raw (hex) version, and compare the output of BrowserGather to figure out which username/password the mismtach occurred on (you'll know because the usernames/passwords will all be mismatched right after it occurs). I am unfortunately too busy at the moment to keep adjusting the regexs for every edge case, but I hope you found this informational helpful. Good luck!

On Wed, Jul 26, 2017 at 9:02 AM, Drazen Mokic notifications@github.com wrote:

Hi,

i get this error every time i run the script "The number of users is different than the number of passwords! This is most likely due to a regex mismatch".

I ma running Win7 in a VM with only 1 User on the system and latest Google Chrome. I ran the script in 32bit powershell.

What is the issue here?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/sekirkity/BrowserGather/issues/3, or mute the thread https://github.com/notifications/unsubscribe-auth/AP2Hl7oAjC1kxGGRDyS7ufr3XlDRUIg1ks5sRzj4gaJpZM4Oj4-i .

hannajs commented 7 years ago

Sometimes there is 3 bytes after x0D x0D x0D in second regex. '(?<=\x0D\x0D\x0D[\s\S]{2,3}\x68\x74\x74\x70) instead of '(?<=\x0D\x0D\x0D[\s\S]{2}\x68\x74\x74\x70) should work

Hipapheralkus commented 6 years ago

I have the same issue - I have a single Chrome password stored ("test@test.test") with password "Password.1" on Facebook, and I get the same error:

Get-ChromeCreds : The number of users is different than the number of passwords! This is most likely due to a regex mis
match.
At line:1 char:1
+ Get-ChromeCreds | format-list *
+ ~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-ChromeCreds

Any possibility to fix it?

djhohnstein commented 6 years ago

For anyone else coming to this thread looking for answers, I can confirm @hannajs fix worked just fine. Changing the user regex from {2} to {2,3} fixes the problem.

hannajs commented 6 years ago

I've figured out that when you press "Do not store password for this website" (or smth like that) in Chrome, it saves website address w/o password. It causes "The number of users is different than the number of passwords!" error. Just ignore it :)