We are covering few small utilities by NirSoft which will expose lack of security in worlds top browser (as per stats) Internet Explorer, famous email client Outlook Express and my favorite GoogleTalk, Pidgin.
In total four programs tested which are presented below. All these utilities are free, small zip files (around 30-60KB in size) and requires no installation. Just download, unzip and run! Also these are only for Windows Platform (tested on Windows XP).
Please note each of following utility claimed to work with many programs. Program names highlighted in bold are tested successfully by us. We could not test rest of the programs due to technical limitations.
#1. PSPV (Protected Storage Password Viewer)
This utility can show passwords from following programs:
- Internet Explorer 6.0
- Outlook Express
- MSN Explore
Some antivirus notably Quick-Heal & McAfee detects pspv as its popularity grew over the time. I am using this for more than a year. In earlier days it never got caught! 😉
PSPV Links: Download | Homepage
#2. IEPV (Internet Explorer Password Viewer)
This utility can show passwords from following programs:
- Internet Explorer 6.0
- Internet Explorer 7.0
If you are Internet Explorer user please consider switching to better and secure browser like Firefox! 🙂
IEPV Links: Download | Homepage
#3. MSPASS (Messenger Password Viewer)
This utility can show passwords from following messenger:
- MSN Messenger
- Windows Messenger (In Windows XP)
- Windows Live Messenger (In Windows XP And Vista)
- Yahoo Messenger (Versions 5.x and 6.x)
- Google Talk
- ICQ Lite 4.x/5.x/2003
- AOL Instant Messenger v4.6 or below, AIM 6.x, and AIM Pro.
- Trillian
- Miranda
- GAIM/Pidgin (more about pidgin)
- MySpace IM
MSPASS Links: Download | Homepage
#4. MAILPV (Mail Password Viewer)
This utility can show passwords from following Email clients:
- Outlook Express
- Microsoft Outlook 2000 (POP3 and SMTP Accounts only)
- Microsoft Outlook 2002/2003/2007 (POP3, IMAP, HTTP and SMTP Accounts)
- Windows Mail
- IncrediMail
- Eudora
- Netscape 6.x/7.x (If the password is not encrypted with master password)
- Mozilla Thunderbird (If the password is not encrypted with master password)
- Group Mail Free
- Yahoo! Mail – If the password is saved in Yahoo! Messenger application.
- Hotmail/MSN mail – If the password is saved in MSN/Windows/Live Messenger application.
- Gmail – If the password is saved by Gmail Notifier application, Google Desktop, or by Google Talk.
MAILPV Links: Download | Homepage
All these programs can be accessed via command-line. Command-line options and other usage details explained in chm help file which you will find after unzipping above utilities.
Geeks may like to use command-line versions with batch scripting from @&^#@%^$!%^$! Hey do not expect me to reveal more… I am not running school for script kiddies! 😛
More NirSoft Links: Top 10 Tools | Password Tools | Source Code Samples
(Disclaimer: Information presented in this article is purely to educate user about security vulnerabilities in some top products used by us in day to day life. Any misuse of this information may subject you to legal actions. Devils Workshop will not be liable for any damage as per our ToS.)
14 Comments
You could also look at SIW which does all this and more. Once You have used SIW, ur bag of software tools becomes lighter. This is a must have for all kinds of tech support jobs.
@Devdatta
I tested SIW. First its heavy and more resource intensive!
Its more like system tweaking tools…
I like the way it shows firefox passwords when master password is not there!
Still I will like to stick to these utilities as with batch files I can do some really cool stuff which is not possible by SIW 😉
Seems all too easy to gain access to sensitive info. That’s why I use a separate password manager
@Louise
Well there is a better solution… Use firefox with master password! 🙂
If we use the computer only by ourself, the password problem would probably won’t arise.
@soleh
If you think your system is physically secured then above softwares may not work!
But still an attacker if manage to execute some code remotely on machine then he can download above small utilities on your machine and then…%@#$@#$% 😉
Would you be able to tell me how to find out the password stored in Safari for Windows. I am desparately looking to find out the password for a website that I have forgotten.
@Aranya
Safari is more secure for IE so I don’t think it will be easy.
Anyway if I find a tool like this for safari on windows, I will post about it.
You may subscribe to my RSS feed or email alert to receive automatic updates in future!
That means.. anyone can view my Google Talk pass by installing a small app on my system :-s
@Gautam
Technically it is more severe as one need not install application on your system.
One can just “execute” a small exe file and get your password.
@ Gautam : Yes…be careful! 😉
I would like to know if we can retrieve the Gmail password from the safari client on a macbook…….. PLease Advice and thanks! in advance.
Regards,
Dia
thnxxx….!! it works 4 me…. 4 tht i say jst thnx……!!!!