Browse Live Discover and Response Queries by Category
Complete

NOTE: SQLite does not support looping, instead consider using WITH RECURSIVE.

"Looping" through list in Live Query

Good afternoon!

I am working on a query where I would like to essentially perform a "For Each Loop" on the results.

I am not sure what the SQL equivalent is.

Can someone assist me and/or direct me to the proper syntax?

Based on the following query, I would like to "grep" each of the file paths for a string.

SELECT path, directory, filename FROM file WHERE directory LIKE 'C:\users\%\AppData\Local\Google\Chrome\User Data\Default%%' AND filename IS 'Preferences'

Example grep query to be run on each discovered file path:

SELECT line FROM grep WHERE pattern = 'test' AND path = 'C:\users\bobjoe\AppData\Local\Google\Chrome\User Data\Default\Preferences'

Thanks!

Kyle Parrish
Parents Comment
  • in reply to Kyle Parrish

    Hello , 
    There is a limitation for the grep table to read the characters per line i.e 1k chars/line. If the limit exceeds it returns no data. I could see the preference file has more than 10k chars in a single line(may differ from machine to machine).

    This query didn't return any data for me.
    SELECT line from grep where pattern = '{' and path in (select path from file where path LIKE 'C:\users\%\AppData\Local\Google\Chrome\User Data\Default%%' AND filename IS 'Preferences')

    However, I see you are able to get the data for the same, Could you share your preference file(to check the JSON format) or just the snippet of it?

Children
Unfiltered HTML