Ever wonder if it's possible to find out what websites individuals go when logged onto the server/PC? Besides checking the Proxy server, or the firewall, you can try this:
Save below code as .html!
CODE
<HTML><HEAD><TITLE>IE Spy - by Vengy</TITLE></HEAD><pre>
<script language="VBScript" TYPE="text/vbscript">
' ======================== Let The Games Begin! ======================== ' Contact Info ' ------------ ' Author: Vengy ' Email : cyber_flash@hotmail.com
' How it works ' ------------ ' INDEX.DAT files keep a list of websites you have visited, cookies received and files opened/downloaded. ' As a result anyone can find out what you have been doing on the Internet! ' ' This program scans all history index files looking for any HTTP:// or FILE:// entries. ' If found, they're stored in a file called C:\SPY.HTM along with the user.
' Aside: This program invokes a local windows program called FIND.EXE to ' parse the index.dat files. (I was too lazy to code it myself. ;)
' Have Fun! (-_-)
' ======================== The Banner ======================== document.writeln "INDEX.DAT files keep a list of websites you have visited, cookies received and files opened/downloaded." document.writeln "As a result anyone can find out what you have been doing on the Internet!"+VBNewLine document.writeln "This program scans all history index files looking for any HTTP:// or FILE:// entries." document.writeln "If found, the User/URL's are stored in a file called C:\SPY.HTM."+VBNewLine
' ======================== ActiveX Warning ======================== MsgBox "NOTE: Please click 'Yes' if prompted with the following message:"+VBNewLine+VBNewLine+"An ActiveX control on this page might be unsafe to"+VBNewLine+"interact with other parts of the page. Do you want to"+VBNewLine+"allow this interaction?"+VBNewLine+VBNewLine+"Click OK to start Spy scan ...",vbOKOnly,"Welcome"
' ======================== Setup Objects ======================== Dim oFSO : Set oFSO = CreateObject("Scripting.FileSystemObject") Dim arrFiles : arrFiles=Array() Dim oWShell : Set oWShell = CreateObject("WScript.Shell")
' ======================== Locate Index.Dat Folder ======================== ' ---> WINXP/2K If oFSO.FolderExists("C:\Documents and Settings\") Then index_folder = "C:\Documents and Settings" ' ---> WIN9X Elseif oFSO.FolderExists("C:\windows\") Then index_folder = "C:\windows" ' ---> Browse For Folder Else index_folder = fnGetMyPathVB End If
' ======================== Start Spy Scan ======================== If index_folder="None" Then MsgBox "No Specified Folder. Scan Aborted." Else Set oStartDir = oFSO.GetFolder(index_folder) sFileRegExPattern = "\index.dat$" RecurseFilesAndFolders oStartDir, sFileRegExPattern DisplayResults End If
' ======================== Find ALL Index.Dat Files ======================== Sub RecurseFilesAndFolders(oRoot, sFileEval) Dim oSubFolder, oFile, oRegExp Set oRegExp = New RegExp oRegExp.IgnoreCase = True
window.status="Scanning: "+oRoot
If Not (sFileEval = "") Then oRegExp.Pattern = sFileEval For Each oFile in oRoot.Files If (oRegExp.Test(oFile.Name)) Then If (InStr(oFile.Path,"History.IE")<>0) Then ReDim Preserve arrFiles(UBound(arrFiles) + 1) arrFiles(UBound(arrFiles)) = oFile.Path End If End If Next End If
For Each oSubFolder In oRoot.SubFolders RecurseFilesAndFolders oSubFolder, sFileEval Next End Sub
' ======================== Display Results ======================== Sub DisplayResults()
Dim sReadLine, sArray, start, count,ub Const ForReading = 1
Window.status="Scanning ..."
Set oTextStream = oFSO.CreateTextFile("C:\spy.bat") oTextStream.Write "echo off"+VBNewLine
count=0 ub=UBound(arrFiles) For Each elem In arrFiles count=count+1 document.writeln elem oTextStream.Write "echo Remaining Scans: "+CStr(ub+1-count)+VBNewLine oTextStream.Write "find "+chr(34)+"http://"+chr(34)+" "+chr(34)+elem+chr(34)+" >>c:\spy.txt"+VBNewLine oTextStream.Write "find "+chr(34)+"file://"+chr(34)+" "+chr(34)+elem+chr(34)+" >>c:\spy.txt"+VBNewLine Next
oTextStream.Close
If count=0 Then Window.status="Aborted." MsgBox "No Index.dat files found. Scan Aborted." Exit Sub End If
oWShell.Run "c:\spy.bat", , True
oFSO.DeleteFile "C:\spy.bat"
If oFSO.FileExists("C:\spy.htm") Then oFSO.DeleteFile "C:\spy.htm" End If
Set oTextStream = oFSO.CreateTextFile("C:\spy.htm") Set oFilein = oFSO.OpenTextFile("c:\spy.txt",ForReading)
oTextStream.Writeline "<html><title>IE is spying on you!</title><body><b>Welcome</b><br><font size=2>"
Do While Not oFilein.AtEndOfStream sReadLine = oFilein.ReadLine start = Instr(sReadLine,": ") If start <> 0 Then sReadLine = Mid(sReadLine,start+2) sArray = Split(sReadLine,"@") oTextStream.Write sArray(0) ' User oTextStream.Writeline " <a href="+sArray(1)+">"+sArray(1)+"</a><br>" ' Visited URL End If loop
oTextStream.Writeline "</font><b>End of Report</b></body></html>"
' +----------------------------------+ ' | Let The Games Begin! | ' +----------------------------------+ ' INDEX.DAT files keep a list of websites you have visited, cookies received and files opened/downloaded. ' As a result anyone can find out what you have been doing on the Internet!
' This program scans all History index files only (not cookies or temporary internet files) ' looking for any protocol :// entries. If found, they're stored in a file called c:\spy.htm.
' When the scan completes, you will have the option to remove specific IE history files!
' Aside: This program invokes a local windows program called FIND.EXE to ' parse the index.dat files. (I was too lazy to code it myself. ;)
' Have Fun! (-_-)
' +---------------------------------+ ' | Ensure that all variable names are defined! | ' +---------------------------------+ Option Explicit
' +--------------------------------+ ' | Setup Objects and misc variables | ' +--------------------------------+ Dim oFSO : Set oFSO = CreateObject("Scripting.FileSystemObject") Dim oWShell : Set oWShell = CreateObject("WScript.Shell") Dim objNet : Set objNet = CreateObject("WScript.Network") Dim Env : Set Env = oWShell.Environment("SYSTEM") Dim arrFiles : arrFiles = Array() Dim objIE Dim objProgressBar Dim objTextLine1 Dim objTextLine2 Dim objQuitFlag Dim spyPath Dim index
' +------------------------------+ ' | Determine OS type. Must be Windows_NT (windows XP/2K/2K3) | ' +------------------------------+ If StrComp(Env("OS"),"Windows_NT",VBTextCompare) <> 0 Then WScript.Echo "This script supports only Windows NT." & vbNewLine & "Exiting..." CleanupQuit End If
' +---------------------------------+ ' | Cleanup and Quit | ' +---------------------------------+ Sub CleanupQuit() Set oFSO = Nothing Set oWShell = Nothing Set objNet = Nothing WScript.Quit End Sub
' +--------------------------------+ ' | Start Spy Scan | ' +--------------------------------+ Sub StartSpyScan() Dim index_folder, history_folder, oSubFolder, oStartDir, sFileRegExPattern, user
index_folder=LocateIndexFolder()
If index_folder="None" Then MsgBox "No folder specified. Scan Aborted." Else
StartIE "IE Spy" SetLine1 "Locating history files:"
sFileRegExPattern = "\index.dat$" Set oStartDir = oFSO.GetFolder(index_folder)
For Each oSubFolder In oStartDir.SubFolders history_folder=oSubFolder.Path&"\Local Settings\History\History.IE5" If oFSO.FolderExists(history_folder) Then
If IsQuit()=True Then CloseIE CleanupQuit End If
user = split(history_folder,"\") SetLine2 user(2)
Set oStartDir = oFSO.GetFolder(history_folder) RecurseFilesAndFolders oStartDir, sFileRegExPattern End If Next
' Index flag to determine if at least one index.dat file exists. If IsEmpty(index) Then CloseIE MsgBox "No Index.dat files found. Scan Aborted." Else CreateSpyTmpFile CreateSpyHtmFile CloseIE RunSpyHtmFile DeleteIndexFiles End If
End If End Sub
' +-------------------------------------+ ' | Locate Index.Dat Folder | ' +-------------------------------------+ Function LocateIndexFolder() ' WINXP/2K If oFSO.FolderExists("c:\Documents and Settings") Then LocateIndexFolder = "c:\Documents and Settings"
' Browse For Folder Else LocateIndexFolder = fnGetMyPathVB End If End Function
' +----------------------------------+ ' | Specify Custom Index.dat Folder | ' +----------------------------------+ Function fnGetMyPathVB() Dim oShell, oFolder, oFolderItem
set oShell = CreateObject("Shell.Application") set oFolder = oShell.BrowseForFolder(0, "Choose your 'Documents and Settings' Folder", 0)
If oFolder is nothing Then fnGetMyPathVB = "None" Else set oFolderItem = oFolder.Items.Item fnGetMyPathVB = oFolderItem.Path End If End Function
' +-------------------------------------------+ ' | Find ALL History Index.Dat Files | ' +-------------------------------------------+ Sub RecurseFilesAndFolders(oRoot, sFileEval) Dim oSubFolder, oFile, oRegExp
Set oRegExp = New RegExp oRegExp.IgnoreCase = True
If Not (sFileEval = "") Then oRegExp.Pattern = sFileEval For Each oFile in oRoot.Files If (oRegExp.Test(oFile.Name)) Then ReDim Preserve arrFiles(UBound(arrFiles) + 1) arrFiles(UBound(arrFiles)) = oFile.Path index=1 ' Found at least one index.dat file! End If Next End If
For Each oSubFolder In oRoot.SubFolders RecurseFilesAndFolders oSubFolder, sFileEval Next End Sub
' +----------------------------------------+ ' | Create Spy.tmp file | ' +----------------------------------------+ Sub CreateSpyTmpFile() Dim sTempTmp, ub, count, elem, user
' Example: C:\Documents and Settings\<username>\Local Settings\Temp\spy.tmp sTempTmp = oFSO.GetSpecialFolder(2)+"\spy.tmp"
' Cleanup old spy.tmp file ... If oFSO.FileExists(sTempTmp) Then oFSO.DeleteFile sTempTmp End If
count = 0 ub = UBound(arrFiles)
For Each elem In arrFiles
If IsQuit()=True Then CloseIE CleanupQuit End If
count = count+1 user = split(elem,"\") SetLine1 "Scanning "+user(2)+" history files:" SetLine2 CStr(ub+1-count)
oWShell.Run "cmd /c find "+chr(34)+"://"+chr(34)+" "+chr(34)+elem+chr(34)+" >>"+chr(34)+sTempTmp+chr(34),0,True Next
' Check that spy.tmp exists. If not oFSO.FileExists(sTempTmp) Then MsgBox "For some odd reason, SPY.TMP does not exist:"+vbCRLF+vbCRLF+sTempTmp+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be tracked. (cyber_flash@hotmail.com)", VBOKonly, "Exiting (code=0)" CloseIE CleanupQuit End If
' Cleanup old spy.htm file ... If oFSO.FileExists(spyPath) Then oFSO.DeleteFile spyPath End If
Set oTextStream = oFSO.CreateTextFile(spyPath)
' Check that spy.htm was created. If not oFSO.FileExists(spyPath) Then MsgBox "For some odd reason, SPY.HTM does not exist:"+vbCRLF+vbCRLF+spyPath+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be tracked. (cyber_flash@hotmail.com)", VBOKonly, "Exiting (code=1)" CloseIE CleanupQuit End If
' Example: C:\Documents and Settings\<username>\Local Settings\Temp\spy.tmp sTempTmp = oFSO.GetSpecialFolder(2)+"\spy.tmp"
Set oFilein = oFSO.OpenTextFile(sTempTmp,1)
oTextStream.WriteLine "<html><title>IE is spying on you!</title><body><b>Welcome "&objNet.UserName&"</b><br>" oTextStream.WriteLine "<table border='0' width='100%'>"
Do While Not oFilein.AtEndOfStream sReadLine = oFilein.ReadLine start = Instr(sReadLine,": ") If start <> 0 Then visit_date=fnFormatDate(sReadLine) sReadLine = Mid(sReadLine,start+2) sArray = Split(sReadLine,"@") 'Visit Date + User + Visited URL oTextStream.WriteLine "<tr><td nowrap><font color=red size=2>"+visit_date+"</font></td>"+"<td nowrap><font color=green size=2>"+sArray(0)+"</font></td>"+"<td nowrap><font size=2><a href="+sArray(1)+">"+sArray(1)+"</a></font></td></tr>" End If loop
oTextStream.WriteLine "</table>"
oTextStream.WriteLine "<br><b>Listing of Index.dat history files:</b><br>" For Each elem In arrFiles oTextStream.WriteLine elem+"<br>" Next
oTextStream.WriteLine "<b>End of Report</b><p><a href=mailto:cyber_flash@hotmail.com?subject=ie_spy>Bugs or Comments? :)</a></p></body></html>"
oFilein.Close oTextStream.Close
' Cleanup temp file ... If oFSO.FileExists(sTempTmp) Then oFSO.DeleteFile sTempTmp End If End Sub
' +----------------------------------------+ ' | Convert Date into readable format | ' +----------------------------------------+ function fnFormatDate(sReadLine) Dim d, tArray
tArray = Split(sReadLine,": ") d=Right(tArray(0),16) If IsNumeric(d) Then fnFormatDate = Left(d,4)+"/"+Mid(d,5,2)+"/"+Mid(d,7,2)+"-"+Mid(d,9,4)+ "/"+Mid(d,13,2)+"/"+Mid(d,15,2) Else 'Date not stored! Let's default something. ;) fnFormatDate = "0000/00/00-0000/00/00" End If End Function
' +-----------------------------+ ' | Run Spy.htm file | ' +-----------------------------+ Sub RunSpyHtmFile() ' Check that spy.htm exists. If not oFSO.FileExists(spyPath) Then MsgBox "For some odd reason, SPY.HTM does not exist:"+vbCRLF+vbCRLF+spyPath+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be tracked. (cyber_flash@hotmail.com)", VBOKonly, "Exiting (code=2)" CleanupQuit Else oWShell.Run chr(34)+spyPath+chr(34) End If End Sub
' +-----------------------------------+ ' | Delete Index.dat files | ' +-----------------------------------+ Sub DeleteIndexFiles() Dim sTempExe, elem
If MsgBox ("Would you like to delete specific Index.dat files?", 65, "Notice")=1 Then
' Example: C:\Documents and Settings\<username>\Local Settings\Temp\deindex.exe sTempExe = oFSO.GetSpecialFolder(2)+"\deindex.exe"
BuildDeIndexFile(sTempExe)
For Each elem In arrFiles If MsgBox ("Delete file upon PC restart?"&vbcrlf&elem, 65, "Delete?")=1 Then oWShell.Run sTempExe+" "+chr(34)+elem+chr(34) End If Next
MsgBox "Any pending file deletions are stored under this registry key:"&vbcrlf&vbcrlf&"HKEY_LOCAL_MACHINE\SYSTEMCurrentControlSet\Control\Session Manager\PendingFileRenameOperations"&vbcrlf&vbcrlf&"If you want to undo the pending deletions, goto the above value and simply delete it! (use: regedit.exe)",0,"Notice" End If End Sub
' +----------------------------------------------+ ' | Build DeIndex.exe (see source code below) | ' +----------------------------------------------+ Sub BuildDeIndexFile(sTempExe) Dim t, i, deindex
If not oFSO.FileExists(sTempExe) Then t=split("4D,5A,90,00,03,00,...00,00,00",",")
Set deindex=oFSO.CreateTextFile(sTempExe,2)
' Check that deindex.exe was created. If not oFSO.FileExists(sTempExe) Then MsgBox "For some odd reason, DEINDEX.EXE does not exist:"+vbCRLF+vbCRLF+sTempExe+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be deleted. (cyber_flash@hotmail.com)", VBOKonly, "Exiting (code=3)" CleanupQuit End If
For i=0 To UBound(t) deindex.Write chr(Int("&H"&t(i))) Next
deindex.Close End If
End Sub
' +------------------------------------------+ ' | Source code for DeIndex.exe | ' +------------------------------------------+ ' ;Title: Delete Index.dat files! ' ;Author: Vengy! (-_-) ' ;Date: 2004 and beyond ... ' ;Tested: Win2K/XP ... ' ;Compiled: MASM32 ' ;Comments: cyber_flash@hotmail.com ' ' ;This program takes the index.dat file path as a commandline argument, ' ;then invokes the MoveFileEx API which deletes the specified file upon RESTART. ' ' ;The Pending file renames are stored under this registry key: ' ;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations ' ' ;Please visit the link below for more details. Thanks! ' ;http://msdn.microsoft.com/library/default.asp?url=... ' ' ' .486p ' .MODEL flat, stdcall ' option casemap:none ' ' include \masm32\include\windows.inc ' include \masm32\include\kernel32.inc ' include \masm32\include\masm32.inc ' includelib \masm32\lib\kernel32.lib ' includelib \masm32\lib\masm32.lib ' ' .DATA ' szSrcFile db MAX_PATH dup(0) ' ' .CODE ' Main: ' invoke GetCL, 1, addr szSrcFile ' invoke MoveFileEx, addr szSrcFile, NULL, MOVEFILE_DELAY_UNTIL_REBOOT ' invoke ExitProcess, 0 ' End Main ' +---------------------------------------+ ' | End of DeIndex.exe source code | ' +---------------------------------------+
' +---------------------------------------+ ' | Launch IE Dialog Box and Progress bar | ' +---------------------------------------+ ' Shamelessly copied from: http://cwashington.netreach.net/depo/view.asp?Inde... Private Sub StartIE(strTitel)
Dim objDocument Dim objWshShell
Set objIE = CreateObject("InternetExplorer.Application")
set objTextLine1 = objIE.document.all("txtMilestone") set objTextLine2 = objIE.document.all("txtRemarks") Set objProgressBar = objIE.document.all("pbText") set objQuitFlag = objIE.document.Secret.pubFlag