# Evil Website (forensics)
We're given a directory containing lots of interesting firefox stuff.
```┌[michal@Bobik] [/dev/ttys002] [master ⚡] └[~/Downloads/Chall]> lsAlternateServices.txt              containers.json                    firebug                            modifyheaders.conf                 serviceworker.txtSecurityPreloadState.txt           content-prefs.sqlite               formhistory.sqlite                 notificationstore.json             sessionCheckpoints.jsonSiteSecurityServiceState.txt       cookies.sqlite                     gmp                                permissions.sqlite                 sessionstore-backupsaddonStartup.json.lz4              cookies.sqlite-shm                 gmp-gmpopenh264                    pkcs11.txt                         shield-preference-experiments.jsonaddons.json                        cookies.sqlite-wal                 gmp-widevinecdm                    places.sqlite                      storageblocklist.xml                      crashes                            handlers.json                      places.sqlite-shm                  storage.sqliteblocklists                         datareporting                      key3.db                            places.sqlite-wal                  times.jsonbookmarkbackups                    extensions                         key4.db                            pluginreg.dat                      weavebrowser-extension-data             extensions.json                    kinto.sqlite                       prefs.js                           webappscert8.db                           favicons.sqlite                    lock                               revocations.txt                    webappsstore.sqlitecert9.db                           favicons.sqlite-shm                logins.json                        saved-telemetry-pings              webappsstore.sqlite-shmcert_override.txt                  favicons.sqlite-wal                mimeTypes.rdf                      search.json.mozlz4                 webappsstore.sqlite-walcompatibility.ini                  features                           minidumps                          secmod.db                          xulstore.json```
Unfortunately, all we had to do is notice a pretty suspicious cookie:
![cookie](cookie.png)
Decoding the base64 gave us a weird `Targa image data` file.You might be tempted to look for some weird ancient software just to view it, but as it turned out that the best way was to actually just import it into gimp as raw data:
![solution](solution.png)
