UBCD4Win Forums > IE Password Recovery

mosigma

Oct 19 2005, 07:11 AM

I am looking for a way to recovery passwords from Internet Explorer. I know where to look in the system registry file to find the passwords, but is there a program that I can add to my UBCD4Win CD collection of tools that will "hash out" what these passwords are for me??

I've seen programs that cost as much as $200. But I need something free.

thanks in advance for the help

And just in case anyone ever wanted to know, the location in the registry file that contains your IE passwords is:

CODE

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\SPW

and your auto complete information is located at:

CODE

HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider

stidyup

Oct 19 2005, 07:36 AM

For me you should never store passwords in IE, nor any browser as it's a security risk.

But that's just my 2 cents

But I don't know of any free program to do what you are asking.

mosigma

Oct 19 2005, 10:53 AM

I agree with you whole heartedly on not storing passwords in browsers. But I have way too many clients to preach this sermon to. I am just happy that the passwords they are using is something other than their d.o.b. or something foolish like that.

I've been searching for programs, but still to no avail.

BvF7734

Oct 19 2005, 02:45 PM

I know ware to get the hacked version but not free. I really do not think you will find a freware utility to do this. But, a place to start thinking about looking is on the darker side of the net. I am sure that there is a utils out there that the H4x0rS out there use to do this. Just be careful when looking though... Alot of those sites out there try to get you to install viruses and trojans and such onto your machine.

Other than looking at the darker areas, I know of no other locals other than buying it or going to the warez scene of which is not promoted here. god am I a hipocrit... j/p

mechmike0034

Oct 20 2005, 09:14 AM

Try these - legit freeware...

Protected Storage Passview: http://www.nirsoft.net/utils/pspv.html

Rock XP: http://www.majorgeeks.com/download4138.html

SteelTrepid

Oct 20 2005, 09:52 AM

I am pretty busy at the moment helping with the ISS, but I would love to hear about these two tools mentioned in the post above. If anyone has the time to check them out, please let us know how they work. I will be on and off throughout the day and will hopefully find the time to check these out myself. If not, I'm sure I'll find time tonight after "networking."

Joshua

Oct 20 2005, 10:01 AM

QUOTE(SteelTrepid @ Oct 20 2005, 04:52 PM)

If anyone has the time to check them out, please let us know how they work.

i have used RockXP very often.
it is a very usefull program.
you can also do the folowing things with it.

- To retrieve and change your XP Key
- To retrieve all Microsoft Products keys
- To save your XP activation file
- To retrieve your lost XP system passwords
- To retrieve your lost RAS (Remote Access Settings) passwords

Joshua

stidyup

Oct 20 2005, 10:04 AM

More on RockXP

QUOTE

RockXP allows you to retrieve and change your XP product key that you used when you installed Windows XP. This can come very handy if you need to reinstall but have misplaced or lost the CD cover with the serial sticker. In addition, the program also lets you save the product activation to a file, enables you to recover usernames and passwords contained in the Windows Secure Storage, recover your Microsoft Windows Products keys and have password generator

RockXP 3.0 allows you to :

- To retrieve and change your XP Key
- To retrieve all Microsoft Products keys
- To save your XP activation file
- To retrieve your lost XP system passwords
- To retrieve your lost RAS (Remote Access Settings) passwords
- And to generate new passwords

Just ran it on Windows seems a nice little tool.

Looks like Joshua posted just before me....

stidyup

Oct 20 2005, 10:05 AM

More info on PassView v1.62

QUOTE

Description
Protected Storage PassView is a small utility that reveals the passwords stored on your computer by Internet Explorer, Outlook Express and MSN Explorer. The passwords are revealed by reading the information from the Protected Storage.
Starting from version 1.60, this utility reveals all AutoComplete strings stored in Internet Explorer, not only the AutoComplete password, as in the previous versions.

This utility can show 4 types of passwords:

1. Outlook passwords: When you create a mail account in Outlook Express or a POP3 account in Microsoft Outlook, and you choose the "Remember password" option in the account properties, the password is saved in the Protected Storage, and this utility can instantly reveal it.

Be aware that if delete an existing Outlook Express account, the password won't be removed from the Protected Storage. In such a case, the utility won't be able to obtain the user-name of the deleted account, and only the password will be shown.
Starting from version 1.50, the passwords of Outlook Express identities are also displayed.

2. AutoComplete passwords in Internet Explorer: Many Web sites provides you a logon screen with user-name and password fields. When you log into the Web site, Internet Explorer may ask you if you want to remember the password for the next time that you log into this Web site. If choose to remember the password, the user-name and the password are saved in the Protected Storage, and thus they can be revealed by Protected Storage PassView.

In some circumstances, multiple pairs of user-name and passwords are stored for the same logon window. In such case, the additional passwords will be displayed as sub-items of the first user-password pair. In sub-items, the resource name is displayed as 3 dots ('...')

3. Password-protected sites in Internet Explorer: Some Web sites allows you to log on by using "basic authentication" or "challenge/response" authentication. When you enter the Web site, Internet Explorer displays a special logon dialog-box and asks you to enter your user-name and password. Internet Explorer also gives you the option to save the user-name/password pair for the next time you log-on. If you choose to save the logon data, the user-name and the password are saved in the Protected Storage, and thus they can be revealed by Protected Storage PassView.
In this category, you can also find the passwords of FTP servers.

4. MSN Explorer Passwords:
The MSN Explorer browser stores 2 types of passwords in the Protected Storage:
* Sign-up passwords
* AutoComplete passwords

Known Problems
False Alert Problems: Some Antivirus programs detect Protected Storage PassView utility as infected with Trojan/Virus.
Recent update: Norton Antivirus detect Protected Storage Passview as an hack tool.

SteelTrepid

Oct 20 2005, 10:20 AM

Good information guys, thanks. I wonder how well they work in PE? I'll be testing them this afternoon if I find time....if not tonight.

stidyup

Oct 21 2005, 02:43 AM

If they don't work in PE they are still useful to have, and user's will just have to run them from the OS.

stidyup

Oct 21 2005, 05:25 AM

Protected Storage Passview: http://www.nirsoft.net/utils/pspv.html

Just done a quick test with this tool and it correctly displayed my Outlook Express password for my email which I stored temporarily to test.