Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Catalog · How the catalog works

Random project

idx-url-extractor

This repository contains a delphi-program that reading .idx(Java app cache) and extracting URLs into the file.

View on GitHub

Anyone may press Interesting, signed in or not. It helps others find this project.

Member rating

No ratings yet.

Sign in to rate this project.

README

IDX-URL-Extractor (Java Cache Analyzer)

Scans Java Applet Cache .idx files to extract URLs and timestamps for forensic analysis.

Overview

A Delphi CLI that parses .idx files (used by Java for caching applets) and extracts:

  • URLs (excluding trusted domains: verisign.com, thawte.com).
  • Timestamps in DD Mon YYYY HH:MM:SS format.

Output format:
<timestamp>|<URL>|<full_path_to_idx_file>.

Details

  • Skips files >100 KB (adjustable via MAX_BYTES_IDX constant).
  • Recursive directory scanning.
  • Supports manual path input or autosearch across all user profiles(digs there via windows registry).
  • All user profiles were available until windows 8 was shown up, modern winsows versions require more effor. I already gave my money so this didn't matter after all :).

HOw to use

cmd
idxurlextractor.exe -p "C:\path\to\java\cache"  # Manual path input  
idxurlextractor.exe -a                          # Scan all user profiles

NOTICE: Java Cache Paths

  • Windows XP:
    C:\Documents and Settings\<user>\Local Settings\Application Data\Sun\Java\Deployment\cache
  • Windows 7+:
    C:\Users\<user>\AppData\LocalLow\Sun\Java\Deployment\cache

📂 Dependencies

  • regUtils.pas (registry helper module). - Local submodule
  • PerlRegEx library (for regex matching). - Must be installed

🔗 About DFIR

  • Investigate malicious Java applet downloads.
  • Hunt for exploitation artifacts (e.g., CVE-2012-4681).