MacOS.Applications.Firefox.History

Read all Users Firefox history.

name: MacOS.Applications.Firefox.History
description: |
  Read all Users Firefox history.

parameters:
  - name: historyGlobs
    default: /Users/*/Library/Application Support/Firefox/Profiles/*/places.sqlite
  - name: urlSQLQuery
    default: |
        SELECT datetime(moz_historyvisits.visit_date/1000000,'unixepoch') AS visit_time, moz_places.url as visited_url,title, visit_count,
             typed, frecency, last_visit_date, description, rev_host, preview_image_url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id
  - name: userRegex
    default: .

reference:
  - https://www.foxtonforensics.com/browser-history-examiner/firefox-history-location
  - https://en.wikiversity.org/wiki/Firefox/Browsing_history_database
  
author: https://github.com/x64-julian

precondition: SELECT OS From info() where OS = 'darwin'

sources:
  - query: |
      LET history_files = SELECT
         parse_string_with_regex(regex="/Users/(?P<User>[^/]+)", string=OSPath).User AS User,
         OSPath
      FROM glob(globs=historyGlobs)

      SELECT * FROM foreach(row=history_files,
        query={
           SELECT User, OSPath,
              visit_time, visited_url, title,description,  visit_count, typed, frecency,
              last_visit_date, rev_host, preview_image_url
          FROM sqlite(
             file=OSPath,
             query=urlSQLQuery)
          })