Lab 6: Browser Forensics - Merekonstruksi Aktivitas Browsing dari Browser Artifacts

# SQLite3 sudah bawaan Ubuntu
which sqlite3 || sudo apt install -y sqlite3

cd ~ && mkdir forensics-lab6 && cd forensics-lab6

python3 << 'PYEOF'
import sqlite3, time, os

# Buat database simulasi Chrome History
db_path = 'simulasi_history.db'

# Hapus kalau sudah ada
if os.path.exists(db_path):
    os.remove(db_path)

conn = sqlite3.connect(db_path)
cur = conn.cursor()

# Buat tabel seperti Chrome nyata
cur.execute('''
CREATE TABLE urls (
    id INTEGER PRIMARY KEY,
    url TEXT NOT NULL,
    title TEXT,
    visit_count INTEGER DEFAULT 0,
    last_visit_time INTEGER
)''')

cur.execute('''
CREATE TABLE visits (
    id INTEGER PRIMARY KEY,
    url INTEGER NOT NULL,
    visit_time INTEGER,
    from_visit INTEGER,
    transition INTEGER
)''')

cur.execute('''
CREATE TABLE downloads (
    id INTEGER PRIMARY KEY,
    current_path TEXT,
    target_path TEXT,
    start_time INTEGER,
    received_bytes INTEGER,
    total_bytes INTEGER,
    state INTEGER,
    url TEXT
)''')

cur.execute('''
CREATE TABLE cookies (
    id INTEGER PRIMARY KEY,
    host_key TEXT,
    name TEXT,
    value TEXT,
    creation_utc INTEGER,
    expires_utc INTEGER,
    last_access_utc INTEGER
)''')

# Chrome timestamp: microseconds since 1601-01-01
def chrome_time(year, month, day, hour=0, min=0, sec=0):
    """Convert to Chrome timestamp format"""
    import datetime
    CHROME_EPOCH = datetime.datetime(1601, 1, 1)
    dt = datetime.datetime(year, month, day, hour, min, sec)
    delta = dt - CHROME_EPOCH
    return int(delta.total_seconds() * 1000000)

# Insert data - simulasi aktivitas browsing
now = time.time()

# Situs normal
sites_normal = [
    ('https://www.google.com', 'Google'),
    ('https://mail.google.com', 'Gmail'),
    ('https://www.youtube.com/watch?v=dQw4w9WgXcQ', 'YouTube Video'),
    ('https://github.com/farishhz', 'Alfarisi Azmir - GitHub'),
    ('https://www.linkedin.com/in/farishhz', 'LinkedIn'),
    ('https://www.dicoding.com', 'Dicoding - Belajar Coding'),
    ('https://stackoverflow.com/questions/123', 'Stack Overflow Question'),
]

# Situs mencurigakan
sites_suspicious = [
    ('https://malware-download-site.com/setup.exe', 'Free Software Download'),
    ('https://darknet-blog.com/hacked-databases', 'Darknet Database Dump'),
    ('https://pastebin.com/raw/abc123def', 'Pastebin - Kredensial Bocor'),
    ('https://phishing-bank-login.com/login.php', 'Bank XYZ - Login'),
    ('https://c2-server.com/command', 'C2 Panel'),
]

all_sites = sites_normal + sites_suspicious

for i, (url, title) in enumerate(all_sites):
    # Spread visits over last 7 days
    day_offset = i % 7
    hour_offset = 9 + (i * 2) % 12
    visit_time = chrome_time(2026, 6, 11 + day_offset, hour_offset, 30 * (i % 4))
    
    cur.execute(
        'INSERT INTO urls (url, title, visit_count, last_visit_time) VALUES (?, ?, ?, ?)',
        (url, title, (i % 3) + 1, visit_time)
    )
    url_id = cur.lastrowid
    
    # Insert corresponding visit
    cur.execute(
        'INSERT INTO visits (url, visit_time, from_visit, transition) VALUES (?, ?, ?, ?)',
        (url_id, visit_time, url_id - 1 if url_id > 1 else 0, 0)
    )

# Downloads - satu file mencurigakan
cur.execute(
    'INSERT INTO downloads (current_path, target_path, start_time, received_bytes, total_bytes, state, url) VALUES (?, ?, ?, ?, ?, ?, ?)',
    ('/home/user/Downloads/setup.exe', '/home/user/Downloads/setup.exe',
     chrome_time(2026, 6, 16, 14, 30), 2048576, 2048576, 1,
     'https://malware-download-site.com/setup.exe')
)

# Cookies
cookies_data = [
    ('mail.google.com', 'session_id', 'abc123def456'),
    ('github.com', 'user_token', 'ghp_xxxxxxxxxxxx'),
    ('phishing-bank-login.com', 'bank_session', 'invalid_session_attemp'),
    ('c2-server.com', 'agent_id', 'bot_1337'),
]

for host, name, value in cookies_data:
    cur.execute(
        'INSERT INTO cookies (host_key, name, value, creation_utc, expires_utc, last_access_utc) VALUES (?, ?, ?, ?, ?, ?)',
        (host, name, value, chrome_time(2026, 6, 11), chrome_time(2026, 7, 11), chrome_time(2026, 6, 16))
    )

conn.commit()
conn.close()

print(f"✅ Database simulasi dibuat: {db_path}")
print(f"   - {len(all_sites)} URL entries")
print(f"   - {len(all_sites)} visit records")
print(f"   - 1 download record")
print(f"   - {len(cookies_data)} cookie records")
PYEOF

# 1. Lihat struktur tabel
echo "=== Struktur Database ==="
sqlite3 simulasi_history.db ".tables"
echo ""
sqlite3 simulasi_history.db ".schema urls"
echo ""
sqlite3 simulasi_history.db ".schema visits"
echo ""
sqlite3 simulasi_history.db ".schema downloads"
echo ""
sqlite3 simulasi_history.db ".schema cookies"

# 2. Semua URL yang dikunjungi
echo "=== Semua History URL ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT id, url, visit_count, last_visit_time FROM urls ORDER BY id;"

# 3. Filter situs mencurigakan
echo ""
echo "=== ⚠️ Situs Mencurigakan ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT url, visit_count FROM urls WHERE url LIKE '%malware%' OR url LIKE '%darknet%' OR url LIKE '%phishing%' OR url LIKE '%c2-%' OR url LIKE '%pastebin%';"

# 4. File yang didownload
echo "=== Download History ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT target_path, total_bytes, url FROM downloads;"

echo ""
echo "⚠️ File setup.exe dari malware-download-site.com - Potensi malware!"

# 5. Cookies - cari session token
echo "=== Cookies ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT host_key, name, value FROM cookies;"

echo ""
echo "⚠️ Cookie 'bank_session' dari phishing-bank-login.com - percobaan phising!"
echo "⚠️ Cookie 'agent_id' dari c2-server.com - komunikasi bot!"

# 6. Buat timeline kronologis
echo "=== Timeline Aktivitas Browsing ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT urls.url, urls.title, visits.visit_time 
   FROM visits 
   JOIN urls ON visits.url = urls.id 
   ORDER BY visits.visit_time;"

# 7. Cari situs yang paling sering dikunjungi
echo ""
echo "=== Top 5 Situs Paling Sering ==="
sqlite3 -header -column simulasi_history.db \
  "SELECT url, visit_count FROM urls ORDER BY visit_count DESC LIMIT 5;"

# Hapus history browser dari CLI (real)
rm ~/.config/google-chrome/Default/History
rm ~/.config/google-chrome/Default/Cookies

# Atau gunakan mode incognito/private
google-chrome --incognito