Hello all of you ...
I think, all of you like to stole a password of your friend so i share with you how to find the password which is store in our pc or our friend pc so i share this things with you..
1)Windows Network Passwords (XP/Vista/2003): When you connect to the file system of another computer on your network (something like \\MyComp\MyFolder), Windows allows you to save the password. If you choose to save the password, the encrypted password is stored in a credential file. The credential file is stored in the following locations: - Windows XP/2003: [Windows Profile]\Application Data\Microsoft\Credentials\[User SID]\Credentials and [Windows Profile]\Local Settings\Application Data\Microsoft\Credentials\[User SID]\Credentials - Windows Vista: [Windows Profile]\AppData\Roaming\Microsoft\Credentials\[Random ID] and [Windows Profile]\AppData\Local\Microsoft\Credentials\[Random ID] You can use http://www.nirsoft.net/utils/network_pas...overy.html to view all passwords stored in these Credentials files.
2)Dialup/VPN Passwords (2000/XP/Vista/2003): Dialup/VPN passwords are stored as LSA secrets under HKEY_LOCAL_MACHINE\Security\Policy\Secrets. This key contains multiple sub-keys, and the sub-keys which store the dialup passwords contains one of the following strings: RasDefaultCredentials and RasDialParams. This key is not accessible from RegEdit and other tools by default, but you can use one of the following methods to access this key: 1. Use at command to run RegEdit.exe as SYSTEM user: (doesn't work under Vista)For Example: at 16:14 /interactive regedit.exe 2. Change the permission of entire Security key. If you do that, it's recommeneded to return the permissions back to the original after you finish.
3)Internet Explorer 4.00 - 6.00: The passwords are stored in a secret location in the Registry known as the [b]"Protected Storage"[/b]. The base key of the Protected Storage is located under the following key: "HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider". In order to view the subkeys of this key in RegEdit, you must do the same process as explained for the LSA secrets. Even when you browse the above key in the Registry Editor (RegEdit), you won't be able to watch the passwords, because they are encrypted. Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys. IE PassView and Protected Storage PassView utilities allow you to recover these passwords.
4)Internet Explorer 7.00 - 8.00:The new versions of Internet Explorer stores the passwords in 2 different locations. AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2. HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords. IE PassView can be used to recover these passwords.
5)Firefox: The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version) These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name] Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.
6)Google Chrome Web browser: The passwords are stored in [Windows Profile]\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (This filename is SQLite database which contains encrypted passwords and other stuff) XP - C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\DefaultVista - C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default
7)Opera: The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile
8)Outlook Express (All Versions): The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
9)Outlook 98/2000: Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.
10)Outlook 2002-2008: All new versions of Outlook store the passwords in the same Registry key of the account settings. The accounts are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index] If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers. http://www.nirsoft.net/utils/mailpv.html can be used to recover lost passwords of Outlook 2002-2008.
11)Windows Live Mail: All account settings, including the encrypted passwords, are stored in [Windows Profile]\Local Settings\Application Data\Microsoft\Windows Live Mail\[Account Name] The account filename is an xml file with .oeaccount extension. http://www.nirsoft.net/utils/mailpv.html can be used to recover lost passwords of Windows Live Mail.
12)ThunderBird: The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name] You should search a filename with .s extension.
13)Google Talk: All account settings, including the encrypted passwords, are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts\[Account Name]
14)Google Desktop: Email passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes\[Account Name]
15)MSN/Windows Messenger version 6.x and below: The passwords are stored in one of the following locations: -Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger - Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MessengerService - In the Credentials file, with entry named as "Passport.Net\\*". (Only when the OS is XP or more)
16)MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds\[Account Name]
17)Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=". These passwords can be recovered by both Network Password Recovery and MessenPass utilities.
18)Yahoo Messenger 6.x: The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager ("EOptions string" value)
19)Yahoo Messenger 7.5 or later: The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager - "ETS" value. The value stored in "ETS" value cannot be recovered back to the original password.
20)AIM Pro: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\AIM\AIMPRO\[Account Name]
21)AIM 6.x: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords [/align]22)ICQ Lite 4.x/5.x/2003:The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Mirabilis\ICQ\NewOwners\[ICQ Number] (MainLocation value)
23)ICQ 6.x: The password hash is stored in [Windows Profile]\Application Data\ICQ\[User Name]\Owner.mdb (Access Database) (The password hash cannot be recovered back to the original password)
24)Digsby: The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat All other passwords are stored in Digsby servers.
25)PaltalkScene: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name].
26)Trillian:Note- These passwords may be stored/encrypted differentlyTrillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:
XP (old version):C:\Program Files\Trillian\users\XP (new version):C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\globalI am not sure on exact but it is somewhere their...
Vista (old version):C:\Program Files\Trillian\users\
Vista (new version):C:\Users\Username\Appdata\Roaming\Trillian\user\global
27) Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=". They a set of Win API functions (Credential API's) to store its' security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the "target name" and "type". If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.
28) No Ip (easy to make in vb.net):Passwords encoded with Base64 you can find the account information in the following locationsHKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\", "Password"HKEY_LOCAL_MACHINESOFTWARE\Vitalwerk\sDUC\", "Checked"HKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\", "UsernameKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "ProxyUsernameHKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "ProxyPassword"HKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "Hosts"
29)Filezilla:Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this
30) Safari:Safari stores password data via Keychain. /Applications/Utilities/Keychain Access (on Mac)On PC, All that data is stored in plist files at: C:Documents and Settings(UserName)Application DataApple ComputerSafariI believe it is FormValues.plist
31)Temporary Internet Files
Windows 7 or VistaC:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\
Windows XP or 2000C:\Documents and Settings\<username>\Local Settings\Temporary Internet Files\
Windows Me,98,95,NTC:\Windows\Temporary Internet Files\C:\Windows\Profiles\<username>\Temporary Internet Files\
Thank you (zer0w0rm)
I think, all of you like to stole a password of your friend so i share with you how to find the password which is store in our pc or our friend pc so i share this things with you..
1)Windows Network Passwords (XP/Vista/2003): When you connect to the file system of another computer on your network (something like \\MyComp\MyFolder), Windows allows you to save the password. If you choose to save the password, the encrypted password is stored in a credential file. The credential file is stored in the following locations: - Windows XP/2003: [Windows Profile]\Application Data\Microsoft\Credentials\[User SID]\Credentials and [Windows Profile]\Local Settings\Application Data\Microsoft\Credentials\[User SID]\Credentials - Windows Vista: [Windows Profile]\AppData\Roaming\Microsoft\Credentials\[Random ID] and [Windows Profile]\AppData\Local\Microsoft\Credentials\[Random ID] You can use http://www.nirsoft.net/utils/network_pas...overy.html to view all passwords stored in these Credentials files.
2)Dialup/VPN Passwords (2000/XP/Vista/2003): Dialup/VPN passwords are stored as LSA secrets under HKEY_LOCAL_MACHINE\Security\Policy\Secrets. This key contains multiple sub-keys, and the sub-keys which store the dialup passwords contains one of the following strings: RasDefaultCredentials and RasDialParams. This key is not accessible from RegEdit and other tools by default, but you can use one of the following methods to access this key: 1. Use at command to run RegEdit.exe as SYSTEM user: (doesn't work under Vista)For Example: at 16:14 /interactive regedit.exe 2. Change the permission of entire Security key. If you do that, it's recommeneded to return the permissions back to the original after you finish.
3)Internet Explorer 4.00 - 6.00: The passwords are stored in a secret location in the Registry known as the [b]"Protected Storage"[/b]. The base key of the Protected Storage is located under the following key: "HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider". In order to view the subkeys of this key in RegEdit, you must do the same process as explained for the LSA secrets. Even when you browse the above key in the Registry Editor (RegEdit), you won't be able to watch the passwords, because they are encrypted. Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys. IE PassView and Protected Storage PassView utilities allow you to recover these passwords.
4)Internet Explorer 7.00 - 8.00:The new versions of Internet Explorer stores the passwords in 2 different locations. AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2. HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords. IE PassView can be used to recover these passwords.
5)Firefox: The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version) These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name] Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.
6)Google Chrome Web browser: The passwords are stored in [Windows Profile]\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (This filename is SQLite database which contains encrypted passwords and other stuff) XP - C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\DefaultVista - C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default
7)Opera: The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile
8)Outlook Express (All Versions): The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.
9)Outlook 98/2000: Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.
10)Outlook 2002-2008: All new versions of Outlook store the passwords in the same Registry key of the account settings. The accounts are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index] If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers. http://www.nirsoft.net/utils/mailpv.html can be used to recover lost passwords of Outlook 2002-2008.
11)Windows Live Mail: All account settings, including the encrypted passwords, are stored in [Windows Profile]\Local Settings\Application Data\Microsoft\Windows Live Mail\[Account Name] The account filename is an xml file with .oeaccount extension. http://www.nirsoft.net/utils/mailpv.html can be used to recover lost passwords of Windows Live Mail.
12)ThunderBird: The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name] You should search a filename with .s extension.
13)Google Talk: All account settings, including the encrypted passwords, are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts\[Account Name]
14)Google Desktop: Email passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes\[Account Name]
15)MSN/Windows Messenger version 6.x and below: The passwords are stored in one of the following locations: -Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger - Registry Key: HKEY_CURRENT_USER\Software\Microsoft\MessengerService - In the Credentials file, with entry named as "Passport.Net\\*". (Only when the OS is XP or more)
16)MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds\[Account Name]
17)Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=". These passwords can be recovered by both Network Password Recovery and MessenPass utilities.
18)Yahoo Messenger 6.x: The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager ("EOptions string" value)
19)Yahoo Messenger 7.5 or later: The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager - "ETS" value. The value stored in "ETS" value cannot be recovered back to the original password.
20)AIM Pro: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\AIM\AIMPRO\[Account Name]
21)AIM 6.x: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords [/align]22)ICQ Lite 4.x/5.x/2003:The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Mirabilis\ICQ\NewOwners\[ICQ Number] (MainLocation value)
23)ICQ 6.x: The password hash is stored in [Windows Profile]\Application Data\ICQ\[User Name]\Owner.mdb (Access Database) (The password hash cannot be recovered back to the original password)
24)Digsby: The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat All other passwords are stored in Digsby servers.
25)PaltalkScene: The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name].
26)Trillian:Note- These passwords may be stored/encrypted differentlyTrillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:
XP (old version):C:\Program Files\Trillian\users\XP (new version):C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\globalI am not sure on exact but it is somewhere their...
Vista (old version):C:\Program Files\Trillian\users\
Vista (new version):C:\Users\Username\Appdata\Roaming\Trillian\user\global
27) Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with "WindowsLive:name=". They a set of Win API functions (Credential API's) to store its' security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the "target name" and "type". If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.
28) No Ip (easy to make in vb.net):Passwords encoded with Base64 you can find the account information in the following locationsHKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\", "Password"HKEY_LOCAL_MACHINESOFTWARE\Vitalwerk\sDUC\", "Checked"HKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\", "UsernameKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "ProxyUsernameHKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "ProxyPassword"HKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\", "Hosts"
29)Filezilla:Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this
30) Safari:Safari stores password data via Keychain. /Applications/Utilities/Keychain Access (on Mac)On PC, All that data is stored in plist files at: C:Documents and Settings(UserName)Application DataApple ComputerSafariI believe it is FormValues.plist
31)Temporary Internet Files
Windows 7 or VistaC:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\C:\Users\<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\
Windows XP or 2000C:\Documents and Settings\<username>\Local Settings\Temporary Internet Files\
Windows Me,98,95,NTC:\Windows\Temporary Internet Files\C:\Windows\Profiles\<username>\Temporary Internet Files\
Thank you (zer0w0rm)
0 comments:
Post a Comment