(IEHistoryView)

{ Viewing Past URL Web History }

1. IEHistoryView extracts information from the history file (index.dat) of Internet Explorer.
   
   • This history information includes the URLs that user visited, the Web site title, The number of times that this URL was visited (Hits column), and the last date/time that the Web site visit occurred.
   • The history file also contains a list of local files that the user opened with Internet Explorer (Usually .html and image files).
   
   
2. Lab Notes
   • In this lab we will do the following:
     1. Download  IEHistoryView
     2. Create Web History
     3. Retrieve Web History with IEHistoryView
     
     
3. Legal Disclaimer
   • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
   • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
   • In addition, this is a teaching website that does not condone malicious behavior of any kind.
   • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
   • © 2012 No content replication of any kind is allowed without express written permission.

1. Start Up Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Click on Edit virtual machine Settings
   • Note(FYI):
     • For those of you not part of my class, this is a Windows XP machine running SP2.
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

    

3. Play Virtual Machine
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Click on Play virtual machine
   • 

    

4. Logging into Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Username: administrator
     2. Password: Use the Class Password or whatever you set it.
   • 

    

5. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 

    

6. Obtain Damn Vulnerable WXP-SP2's IP Address
   • Instructions:
     1. ipconfig
   • Note(FYI):
     • In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.1.116.
     • This is the IP Address of the Victim Machine that will be attacked by Metasploit.
     • Record your Damn Vulnerable WXP-SP2's IP Address.
   • 

1. Start your Internet Explorer Web Browser
   • Instructions:
     1. Start --> All Programs --> Internet Explorer
   • 

    

2. Download IEHistoryView
   • Instructions:
     1. Place http://www.nirsoft.net/utils/iehv.zip in the Address Box and hit enter.
     2. Click Save
   • 

    

3. Save As
   • Instructions:
     1. Navigate to C:\tools
        • If the tools folder does not exist, then create it.
     2. Click the Save Button
   • 

    

4. Click Open Folder
   • Instructions:
     1. Click Open Folder
   • 

    

5. Extract iehv.zip
   • Instructions:
     1. Right Click on iehv.zip
     2. Select Extract All...
   • 

    

6. Select Next
   • Instructions:
     1. Click Next
   • 

    

7. Select Next
   • Instructions:
     1. Click Next
   • 

    

8. Click Finished
   • Instructions:
     1. Click Finished
   • 

1. Open Up Internet Explorer.
   • Instructions:
     1. Start --> All Programs --> Internet Explorer
   • 

    

2. Create Metasploit Web History
   • Instructions:
     1. Go to http://www.metasploit.com
   • 

    

3. Create Nmap Web History
   • Instructions:
     1. Go To http://nmap.org
   • 

    

1. Open My Computer
   • Instructions:
     1. Start --> All Programs --> My Computer
   • 

    

2. Start iehv.exe
   • Instructions:
   1. Navigate to C:\tools\iehv
   2. Right Click on iehv.exe
   3. Click Open
   4. Click Run
   • 

    

3. IEHistoryView
   • Note(FYI):
   1. IEHistoryView shows a simplistic view of URL, Title, Hits, Modified Date, Expiration Date, Username.
   2. You can see WHO viewed WHAT WHEN.
   • 

    

4. Let's do a simply search
   • Instructions:
   1. Select Edit --> Find History Item
   • 

    

5. Enter Search String
   • Instructions:
   1. Find What:  metasploit
   • Note(FYI):
     • This search string is limited to the name of the website and not a content search.
   • 

    

6. Results
   • Note(FYI):
   1. Noticed that http://www.metasploit.com is highlighted.
   • 

    

1. Select All URLs
   • Instructions:
     1. Click on the very first URL
     2. Press and Hold the Shift Button
     3. Click on the very last URL link
   • 

    

2. Select Highlighted Items
   • Instructions:
     1. Edit --> Select Highlighted Items
   • 

    

3. Copy Selected Items
   • Instructions:
     1. Edit --> Copy Select Items (Tab Delimited)
   • 

    

4. Open Notepad
   • Instructions:
     1. Start --> All Programs --> Accessories --> Notepad
   • 

    

5. Paste URL's
   • Instructions:
     1. Edit --> Paste
   • 

    

6. Save URL's
   • Instructions:
     1. File --> Save As...
     2. Navigate to C:\Evidence
        • If you do not have an Evidence Folder, then please create it.
     3. File name: IE-YYYYMMDD.csv
        • YYYY - Represents the Year
        • MM - Represents the Month
        • DD - Represents the Day
        • In my case, I named the file IE-20121215.csv
     4. Click Save
   • 

    

7. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 

    

8. Proof of Lab
   • Instructions:
     1. cd C:\Evidence
     2. dir | findstr IE-20121215.csv
        • Remember, the file name IE-20121215.csv might be differently named according to the today's date.
     3. type IE-20121215.csv | findstr metasploit
     4. date /t
     5. echo "Your Name"
        • This should be your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions
     1. Press both the <Ctrl> and <Alt> keys at the same time.
     2. Do a <PrtScn>
     3. Paste into a word document
     4. Upload to Moodle
   •