skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

browser-forensics

Parse browser artifacts to reconstruct user activity and identify malicious web interactions.

5|Updated Jan 12, 2026
Search Tags:#artifacts#history#browser#analyze#forensics#cookies#downloads
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill browser-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: browser-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/browser-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill browser-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps investigators parse and interpret web browser artifacts to reconstruct user activity, identify malicious sites, and support incident response across major browsers.

Core Features & Use Cases

  • Browsing History Analysis: Extracts and correlates history data from Chrome, Firefox, Edge, Safari, and IE.
  • Cookie and Credential Insight: Decrypts and analyzes cookies, form autofill data, and stored credentials where permitted.
  • Cross-Browser Artifacts: Collects downloads, cache, bookmarks, extensions, and session data for comprehensive timelines.
  • Use Case: A SOC analyst can quickly assemble a cross-browser activity timeline to identify suspicious visits and data exfiltration patterns.

Quick Start

Analyze a user's browser profile directory (for example /evidence/user_profile/) to generate an artifacts report.

Frequently Asked Questions about browser-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze browser artifacts across Chrome, Firefox, and Edge for incident response?▼

Browser artifact analysis across Chrome, Firefox, Edge, Safari, and IE extracts history, cookies, cache, and credentials to reconstruct user activity and identify malicious web interactions.

Can I decrypt cookies and stored credentials from a user's browser profile directory?▼

Yes, browser artifact analysis decrypts cookies, form autofill data, and stored credentials where permitted, requiring Python-based artifact parsers and optional decryption utilities to process the profile directory.

What is the best way to build a cross-browser activity timeline from web history and downloads?▼

Building a cross-browser activity timeline requires normalizing history, downloads, cache, bookmarks, and session data across browsers to generate comprehensive reports correlating user interactions.

Does browser forensics support parsing cache, autofill data, and extensions for comprehensive artifact collection?▼

Browser forensics supports parsing cache, autofill data, bookmarks, extensions, and session data, processing these artifacts alongside history and downloads to support incident response timelines.

Do I need Python-based artifact parsers to normalize cross-browser history and generate forensic reports?▼

Yes, Python-based artifact parsers are required with optional decryption utilities to perform cross-browser normalization and generate forensic reports from the collected web artifacts.

When should I use browser artifact analysis to identify malicious sites and data exfiltration patterns?▼

Browser artifact analysis should be used when investigating suspicious visits and data exfiltration patterns, allowing SOC analysts to quickly assemble cross-browser activity timelines from parsed history and credentials.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

analyzing-windows-lnk-files-for-artifacts

Extract forensic artifacts from Windows LNK shortcut files.

Community
Advanced
redhat-etredhat-et
1

investigate-incident

Investigate platform incidents by gathering evidence and generating root cause documentation.

Official
Advanced
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced
untangledfinanceuntangledfinance

chrome-devtools

Automate browser testing and debugging with Puppeteer CLI scripts for Chromium-based browsers.

Official
Advanced