Rewrite

.gitignore

@@ -2,6 +2,9 @@
 # Created by https://www.gitignore.io/api/code,python,windows
 # Edit at https://www.gitignore.io/?templates=code,python,windows
 
+tox.ini
+.gitignore
+
 ### Code ###
 .vscode/*
 
@@ -142,4 +145,4 @@ TransportSecurity
 wordlist.txt
 .venv
 
-flake8.xml
+flake8.xml

hstsparser/__init__.py

@@ -0,0 +1,42 @@
+"""
+HSTSParser: Parse browser HSTS databases into forensic artifacts.
+
+Usage:
+  hstsparser table [--firefox|--chrome] [--sort=<column>] [<path>]
+  hstsparser -h | --help
+  hstsparser --version
+
+Options:
+  -h --help            Show this screen.
+  --version            Show version.
+  path                 Folder to search, or path to HSTS file.
+  --sort=<column>      Sort a specified column [default: Last Accessed].
+"""
+
+__version__ = '1.2.0'
+
+import importlib
+import platform
+
+from docopt import docopt
+
+from hstsparser.utils import HSTSReader
+
+
+system = platform.system()
+
+if system == 'Windows':
+    win32api = importlib.import_module('win32api')
+    *drives, _ = win32api.GetLogicalDriveStrings().split('\000')
+    print(drives)
+
+
+def main() -> None:
+    """Entry point for the command-line alias."""
+    arguments = docopt(__doc__, version=f'hstsparser {__version__}')
+    browser = 'firefox'
+    if browser == 'chrome':
+        pass
+    else:
+        pass
+    print(arguments.get('--sort'))

hstsparser/__main__.py

@@ -0,0 +1,5 @@
+"""Executed on 'python -m hstsparser'."""
+
+from hstsparser import main
+
+main()

hstsparser/constants.py

@@ -0,0 +1,17 @@
+"""Constants and Enums for use in HSTSReaders."""
+
+
+class Paths:
+    """Location of HSTS databases."""
+
+    class Windows:
+        """Location of HSTS Files on Windows."""
+
+        CHROME = r'Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\SiteSecurityServiceState.txt'
+        FIREFOX = r'Users\*\AppData\Local\Google\Chrome\User Data\TransportSecurity'
+
+    class Linux:
+        """Location of HSTS Files on Linux."""
+
+        CHROME = 'home/*/.config/google-chrome*/Default/TransportSecurity'
+        FIREFOX = 'home/*/.mozilla/firefox/*/SiteSecurityServiceState.txt'

hstsparser/utils.py

@@ -0,0 +1,49 @@
+"""Utilities for reading and parsing HSTS databases."""
+
+import re
+from datetime import datetime, timedelta
+from pathlib import Path
+from typing import Iterator, TextIO, Union
+
+
+class HSTSReader:
+    """Implements a HSTS database reader."""
+
+    def __init__(self, file: Union[str, Path], browser: str) -> None:
+        """Initialise attributes."""
+        if type(file) is str:
+            file = Path(file).expanduser()
+        self.file = file
+        self.browser = browser
+
+    @staticmethod
+    def chrome(file: TextIO) -> Iterator:
+        """Read a chrome database."""
+        ...
+
+    @staticmethod
+    def firefox(file: TextIO) -> Iterator:
+        """Read a firefox database."""
+        pattern = re.compile(r'\s+|:|,')
+        for line in file:
+            record = pattern.split(line)
+            domain, htype, visits, access, expires, _, subdomains, *_ = record
+            expiry = int(expires) / 1000 if expires.isnumeric() else 32503680000
+            yield [
+                domain.split('^')[0],
+                int(visits),
+                datetime.utcfromtimestamp(0) + timedelta(int(access)),
+                datetime.fromtimestamp(expiry),
+                htype,
+                'No' if subdomains == '0' else 'Yes'
+            ]
+
+    def __iter__(self) -> Iterator:
+        """Return the relevant iterator."""
+        with self.file.open() as file:
+            if self.browser == 'firefox':
+                yield from self.firefox(file)
+            elif self.browser == 'chrome':
+                yield from self.chrome(file)
+            else:
+                raise Exception