How could one get the "visiting url"

c++ / delphi package - dll injection and api hooking
Post Reply
SittingBull
Posts: 23
Joined: Fri Jun 03, 2005 2:17 pm

How could one get the "visiting url"

Post by SittingBull »

Hi yall,

How could one hook the Mozilla's Firefox address bar or IE's bar in order to extract the currently visiting URL?

I've been trying to create a site logger, and tryed to make it as general as possible, so hooking winsock seamed the right choice, the only problem is that by parsing HTTP packets one gets every single URL (images, ads, pages, frames, etc...).

Is there any other way one could do this?

All sugestions are pretty wellcome :D,

Regards,
SittingBull
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Have you tried WM_GETTEXT?
iconic
Site Admin
Posts: 1065
Joined: Wed Jun 08, 2005 5:08 am

Post by iconic »

No need to hook WinSock, most browsers act as (Dynamic Data Exchange) DDE servers so any DDE Client can access elements, in your case the website URL one wishes to visit. I wrote a commercial project in Delphi last year and I used something similar in it myself.

Note: If memory serves me correct the Mosaic browser doesn't like the DDE SetLink() --> RequestData() methods and the result is similar to that of typing out each char and have the url show up as exactly that, rather than as the complete URL string. It seems to work flawlessy on every other browser that i've come in contact with.


Code: Select all

procedure GetCurrentURL(out URL, Title: string);
var
   DDEClient : TDDEClientConv;
   p, q: PChar;
   i: Integer;
begin
   DDEClient := TDDEClientConv.Create(nil);
   try
     with DDEClient do if SetLink('IExplore', 'WWW_GetWindowInfo') or
       SetLink('Netscape', 'WWW_GetWindowInfo') or
       SetLink('Mosaic', 'WWW_GetWindowInfo') or
       SetLink('Netscp6', 'WWW_GetWindowInfo') or
       SetLink('Mozilla', 'WWW_GetWindowInfo') or
       SetLink('Firefox', 'WWW_GetWindowInfo') then
       p := RequestData('0xFFFFFFFF')
     else raise Exception.Create('Could not establish browser DDE link');
     if Assigned(p) then try
       q := p;
       Assert(q^ = '"');
       SetLength(URL, StrLen(q));
       Inc(q);
       i := 0;
       while q^ <> '"' do begin
         if (q^ = '\') and (q[1] = '"') then Inc(q);
         Inc(i);
         URL[i] := q^;
         Inc(q);
       end;
       SetLength(URL, i);
       SetLength(Title, StrLen(q));
       i := 0;
       Inc(q, 3);
       while q^ <> '"' do begin
         if (q^ = '\') and (q[1] = '"') then Inc(q);
         Inc(i);
         Title[i] := q^;
         Inc(q);
       end;
       SetLength(Title, i);
     finally
       StrDispose(p);
     end else raise Exception.Create('Could not fetch browser data');
   finally
     DDEClient.Free;
   end;
end;

--Iconic
SittingBull
Posts: 23
Joined: Fri Jun 03, 2005 2:17 pm

Post by SittingBull »

Thanks for your reply,

I've been reading about browsers support for DDE.

WWW_GetWindowInfo extracts the info I need, the only problem is that I've to connect to the browser within a cicle so that I would detect url changes.

I've seen another DDE topic that would send back to my app every URL change (WWW_RegisterURLEcho), wich works fine with IExplorer, the problem is that it seems not to work with Mozilla, though netscape's documentation says it is supported :P.

Do you know if it supports it? Pherhaps there's another way of getting this, though I cant seem to discover it... :sorry:

Regards,
SittingBull
iconic
Site Admin
Posts: 1065
Joined: Wed Jun 08, 2005 5:08 am

...SittingBull

Post by iconic »

I don't know if Mozilla browsers support WWW_RegisterURLEcho directly, actually i doubt they do. Also, you'd have to function as both a DDE client and a DDE server (I imagine) to even use WWW_RegisterURLEcho since it's server corresponding. I'm no Browser expert :( If you're wanting to cycle why not just setup a timer and set the interval to 1 or 2 seconds so that it calls the function and then you filter for duplicates in your application so that only new URLs are added, that's a cheap way but it will surely work :) If you're looking for an embedded solution maybe look into BHO (browser helper objects), COM programming and/or further your DDE investigation.

Also, it's been well over a year since i looked into Ihtmldocument interfaces and other browser specific stuff but if 2 browers are open at the same time i do believe that IE always takes priority as far as sending DDE messages, the other browsers messages will either have to wait / be queued or simply are disregarded or never sent. If I had more time and wasn't as busy i'm sure i could use some sort of a callback function through a helper object, i lack the time however.

Best regards,
--Iconic
dcsoft
Posts: 380
Joined: Sat Dec 11, 2004 2:11 am
Location: San Francisco Bay Area, CA USA
Contact:

Forget DDE, use WM_GETTEXT

Post by dcsoft »

Madshi is right... use WM_GETTEXT to retrieve the contents of the Address bar Edit window.

The DDE thing worked well back in the version 3.0 of IE and Netscape, but the later versions have not kept up with this method, and anyway, there are problems if there are multiple browsers open, as Iconic has said.

-- David
SittingBull
Posts: 23
Joined: Fri Jun 03, 2005 2:17 pm

Post by SittingBull »

Thanks for all replys,

The DDE thing is proving it self to be hard to integrate within my solution, since the main process is in the system account. :(
dcsoft wrote:Madshi is right... use WM_GETTEXT to retrieve the contents of the Address bar Edit window.
But how does one get the Handle for the address bar on Mozilla firefox for instance? It uses a specific window class, and the address bar is not exposed.

Do you mean intercepting the SendMessage and PostMessage api calls, filtering WM_GETTEXT? :(
When I intercept IExplorer calls with the WM_SETTEXT message I can easly filter the adequate urls, but intercepting WM_GETTEXT doesn't seem to capture any URLs. :(

Best regards,
SittingBull
dcsoft
Posts: 380
Joined: Sat Dec 11, 2004 2:11 am
Location: San Francisco Bay Area, CA USA
Contact:

Post by dcsoft »

WM_GETTEXT won't work with Firefox, since as you've discovered, the address bar isn't an HWND! I don't have an answer for Firefox.

You would do a SendMessage (WM_GETTEXT, ...) to the address bar window in IE to get the contents.

If you want to get notified when the IE address bar has changed (so you can do the above), you need to inject into IE and subclass the address bar HWND.

Cheers,
David
SkyHigh
Posts: 1
Joined: Thu Jul 24, 2014 9:02 am

Re: How could one get the "visiting url"

Post by SkyHigh »

www_getwindowinfo command is now used by cyber-criminals, it is explained here: http://soft2secure.com/knowledgebase/www_getwindowinfo
Post Reply