UlpExtractor

UlpExtractor is a powerful module that extracts URL:Login:Password (ULP) entries from logs and archives. It supports unpacked logs (folders), zip, and rar archives (with or without passwords), and can even extract ULPs from nested archives. This module is essential for recovering credentials from various log sources.

Before using this module, make sure to set up any necessary archive passwords in the main Settings section of Chronos.

Options

Determines the format used when saving extracted data to output files.

Available Formats:

UrlLogPass - Saves data in url:login:password format
LogPassUrl - Saves data in login:password:url format
LogPass - Saves only login:password, discarding the URL
Normal - Preserves the original format found in logs

Choose the format that best suits your downstream processing needs. The most common format is UrlLogPass.

Usage Guide

Follow these steps to effectively use the UlpExtractor module:

Configure Archive Passwords

Before starting, set up any necessary archive passwords in the main Settings section of Chronos.

Select Output Format

Choose the desired format for extracted credentials:

UrlLogPass - Standard format for most purposes
LogPassUrl - Alternative format preferred by some tools
LogPass - For applications that don't need the URL
Normal - To preserve original formatting

Choose Separator

Select the character to separate fields in the output. The default colon ":" works well for most purposes.

Select Source Files

Choose the file or directory containing the logs or archives to process.

Set Optional Filters

Configure any line filters or path masks to target specific content:

Lines Filter - To extract only certain types of credentials
Paths Mask - To focus on specific files within archives

Enable Deduplication

Enable Dedup to ensure each unique credential appears only once in the output.

Execute Extraction

Run the module to begin processing your files. For large archives, this may take some time.

Verify Results

Check the output directory for the extracted ULP files and verify they contain the expected data.

Advanced Extraction Strategies

Regular Expression Resources

For help crafting effective filter patterns and path masks, consider using online regex testing tools like regex101.com.

UlpCleaner - For cleaning and standardizing extracted ULPs
UlpSorter - For organizing extracted ULPs by pattern
Filter - For additional filtering of extracted data