Docs›Using The Tool›HTML Report

HTML Report Guide

The HTML report is the primary output of infostealer_audit.py. This
page explains each tab in detail.

File layout

reports/
├── infostealer_<timestamp>.html              # default
├── infostealer_showpassword_<timestamp>.html # with --showpassword
└── audit_aggressive_<timestamp>.log          # console log from pwd_audit --aggressive

Top banner

The banner at the top has:

A short paragraph under the banner explains what the report represents
and reminds you that the password mode (masked vs. plaintext) is shown.

Tab 1 — Overview

The first thing you see after the banner. It contains the version
comparison matrix:

Column Meaning
Browser Name of the detected browser
Installed Version currently installed on this machine
Current stable Latest stable version fetched live from the vendor
Δ Difference in major version. +0 = up-to-date; +1 = one major behind; +N for older
Risk OK / LOW / MEDIUM / HIGH / CRITICAL based on the gap

Rows with Risk = OK are green. Anything else is amber/red.

Tab 2 — Accounts per browser

For each browser and each profile, a collapsible table with one row per
saved credential. Columns:

Column Meaning
URL The site this credential is for
Username The username (left as stored)
Password Masked (M*****a) or plaintext if --showpassword. For v20-protected, shows [v20-PROTECTED]
Cipher Which encryption scheme was used to store this credential. Colour-coded.
Category Auto-classification: Banking / Email / Cloud-Dev / Gaming / Social / Shopping / Router / etc.
Risk CRITICAL / HIGH / MEDIUM / LOW based on the site category

Sort order: by decryptability first (decrypted on top), then by site
criticality, then by URL.

Cipher legend

Tag Meaning Risk
v10 (AES-GCM + DPAPI user) Chrome 80–126 scheme. User-mode infostealer can decrypt in seconds. 9/10
v20 (ABE - DECRYPTED!) Chrome 127+ App-Bound Encryption, but the tool managed to decrypt it. Indicates aggressive-mode or external help. 8/10
v20-ABE protected Chrome 127+ ABE, the tool could not decrypt. Best protection currently. 2/10
pre-v10 (DPAPI direct) Chrome <80 scheme. Trivial to decrypt. 10/10
NSS PBKDF2+AES-256 Firefox scheme. Decryptable in user-mode unless a Primary Password is set. 6/10

Tab 3 — Versions & CVE

Reproduces the version comparison from Overview plus, for each
installed browser, the list of bypass techniques known to work
against that version, sourced from the KB.

Each bypass technique is shown as a card with:

At the bottom: a "Fix" call-out with the milestone version and release
date that fixed each technique.

Tab 4 — Targets

A table of nine classic infostealer targets:

Target Description
Discord Token %APPDATA%\discord\Local Storage\leveldb
Steam autologin loginusers.vdf + ssfn* files
Crypto wallets (browser ext.) 25+ wallet extension IDs
Telegram Desktop session tdata folder
SSH private keys ~/.ssh/id_rsa, id_ed25519, etc.
GPG keyring ~/AppData/Roaming/gnupg
FileZilla saved sites sitemanager.xml
Windows Credential Manager total entry count
VPN client configs OpenVPN .ovpn, WireGuard configs

Each row is colour-coded: amber if present, grey if not. Value column
shows the severity rating for an attacker.

Tab 5 — LaZagne Light

Built-in pure-Python replica of the most useful LaZagne categories.
Each subsection has its own table:

If your PC is a desktop without a wireless adapter you will see "Wi-Fi
profiles (n/a)" instead of an empty table — the tool detects the
wlansvc service not running.

Tab 6 — Legacy credentials

Tab 7 — Recovery tools

Status of the optional external Python tools the audit can leverage:

Each card shows: installed yes/no, whether it was newly installed or
upgraded on this run, the GitHub URL, and use-case examples.

Tab 8 — Fix recommendations

Ordered by priority: CRITICAL first. Each card has:

Examples:

Tab 9 — ABE Timeline

Chrome version ranges from < 127 to >= 148, each annotated with:

The row matching your Chrome version is highlighted in blue.

This is the most useful tab for understanding why the answer is what
it is. Read it top-to-bottom.

Multilanguage support

The HTML report is fully localised in five languages:

Code Language Auto-detected from
it Italiano Windows locale it-IT, it-CH, etc.
en English Any locale not matched below (default)
fr Français Windows locale fr-*
de Deutsch Windows locale de-* (also --lang du)
es Español Windows locale es-*

The language is auto-detected from the Windows registry key
HKCU\Control Panel\International\LocaleName at runtime. You can
override it with --lang:

py infostealer_audit.py --lang fr
py pwd_audit.py --lang de

Every string in the report — tab names, column headers, stat-box
labels, warning messages, fix recommendations wording — is translated.
The <html lang="xx"> attribute is also set correctly, which helps
screen readers and browser spell-checkers.

Translations live in modules/i18n.py. See
Architecture for details, and
Adding a Browser for the extension pattern
(the same applies to adding a new language).

Preview without running the tool

Five sanitized demo reports (one per language) are available in
wiki/demo-reports/:

Report Language
IT_infostealer_demo.html 🇮🇹 Italiano
EN_infostealer_demo.html 🇬🇧 English
FR_infostealer_demo.html 🇫🇷 Français
DE_infostealer_demo.html 🇩🇪 Deutsch
ES_infostealer_demo.html 🇪🇸 Español

All personal data in those files has been replaced with fictional
placeholders. See Demo Reports for the full
description.

Saving and sharing reports