How do I use SQLite to read data from the Firefox cookies file?

39,183

I had the same problem trying to read the cookies.sqlite file on Mac OS 10.6.8 (Snow Leopard). I downloaded SQLite 3.7.10 from http://www.sqlite.org/download.html and then I could open the file.

Here's a walkthrough of what I did...

  • Download SQLite 3, go to your downloads folder and unzip the file so that you now have a new SQLite 3 sitting in your downloads folder.
  • Open up a new finder window, press CMD + Shift + G, in the 'go to' dialog that pops up enter ~/Library/Application Support/Firefox/Profiles and then press return.
  • Presuming you only have one Firefox profile, you should see a folder here called XXXXXXXX.default (where the XXX string will be some random characters). Open this folder, or if you have more than one profile, open the folder of the profile you are looking for.
  • Inside you will find the cookies.sqlite database file, you can use this here directly, but you might want to make a copy somewhere else to use without risk of messing up the one that Firefox uses. If you want to use the Firefox one directly then I think you have to quit Firefox first, otherwise it has a lock on the file.
  • Open a new terminal window, and drag the sqlite3 binary from the downloads folder to the terminal window, this should enter the path to sqlite3 onto the command line.
  • Now, drag the cookies.sqlite3 database (the original or your copy) to the terminal, press return in the terminal.

If all goes well you should get the sqlite> command prompt. If you enter .tables you should see the table moz_cookies, which you can then query and investigate further.

The following commands might help:

.mode column
.headers on
select * from moz_cookies where domain = '.stackoverflow.com';

You should see all the values stored in your cookie for this site.

If you want to update the existing sqlite3 on your Mac, I did sudo mv /usr/bin/sqlite3 /usr/bin/sqlite3.old (just in case of any future problems, I can move it back again) and then sudo mv ~/downloads/sqlite3 /usr/bin/sqlite3.

Share:
39,183
cwd
Author by

cwd

Updated on July 09, 2022

Comments

  • cwd
    cwd over 1 year

    In my Firefox profile directory there is a cookies.sqlite file which holds the data for Firefox's cookies. I grabbed the Firefox SQLite Manager extension and loaded this file, which works, but how can I use plain query commands to read the cookies out of that file?

    This is what I've tried so far:

    $ sqlite3 cookies.sqlite
    sqlite> SELECT * FROM dbname.sqlite_master WHERE type='table';
    SQL error: file is encrypted or is not a database
    

    I can't even list the tables, so I'm not able to start trying to list the cookies yet. If I can connect I'd like to be able to read and write data there, but I'm new to SQLite.

  • cwd
    cwd almost 12 years
    If you can add more details or an example using this with OS X I will accept this answer
  • ThorSummoner
    ThorSummoner over 4 years
    your link is a dead link
  • ilikeprogramming
    ilikeprogramming over 4 years
    @ThorSummoner - ok, removed it!
  • scavenger
    scavenger over 3 years
    invalid with recent versions of firefox since 70: select returns nothing
  • ilikeprogramming
    ilikeprogramming over 3 years
    @scavenger sorry, I haven't used mac os in ages now
  • ELNJ
    ELNJ about 3 years
    On CentOS 6 this indeed turned out to be a version mismatch, sqlite 3.6 (standard CentOS 6 install) vs. sqlite 3.7 needed to read the Firefox cookie file after the latest update. I was able to install an updated RPM for CentOS 6 using the CERT Forensics Tools repo, centos.pkgs.org/6/forensics-x86_64/…
  • benaja
    benaja almost 2 years
    @ilikeprogramming I think the essence of this method is not system-dependent. I do not understand OS-specific requests in this thread. Your answer should have been accepted years ago. Good job! Congratulations. It works on my Linux desktop right now: Firefox 94 + SQLite 3.31.1 I think it has to work on OS X as well.