Grab file hashes from browser extensions

[jjsendor]

So far OSXCollector can list all extensions from Firefox and Chrome but information about a particular extension is limited only to the information available there (name, install date, update page, etc.).

Getting file hashes from all of the extensions installed on a machine would provide a better insight when investigating whether a malicious extension is installed on the machine.

Firefox and Chrome use standard directories where the extensions are installed so it won't be a problem to get the file hashes from there.

[ivanlei]

Which directories?

[jjsendor]

Firefox extensions are installed in one of the following:

• ~/Library/Application Support/Firefox/Profiles/<profile folder>/extensions/
• ~/Library/Mozilla/Firefox/Profiles/<profile folder>/extensions/

For Chrome it's:

• ~/Library/Application Support/Google/Chrome/Default/Extensions

Safari:

• ~/Library/Safari/Extensions/