plaso.parsers.cookie_plugins package¶

Submodules¶

plaso.parsers.cookie_plugins.ganalytics module¶

This file contains a plugin for parsing Google Analytics cookies.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsEventData(cookie_identifier)[source]¶

Bases: plaso.containers.events.EventData

Google Analytics event data.

cookie_name¶

name of cookie.

Type: str

domain_hash¶

domain hash.

Type: str

pages_viewed¶

number of pages viewed.

Type: int

sessions¶

number of sessions.

Type: int

sources¶

number of sources.

Type: int

url¶

URL or path where the cookie got set.

Type: str

visitor_id¶

visitor identifier.

Type: str

DATA_TYPE = 'cookie:google:analytics'¶

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmaPlugin[source]¶

Bases: plaso.parsers.cookie_plugins.interface.BaseCookiePlugin

A browser cookie plugin for __utma Google Analytics cookies.

The structure of the cookie data: <domain hash>.<visitor ID>.<first visit>.<previous visit>.<last visit>. <number of sessions>

For example: 137167072.1215918423.1383170166.1383170166.1383170166.1

Or: <last visit>

For example: 13113225820000000

COOKIE_NAME = '__utma'¶

DESCRIPTION = 'Google Analytics utma cookie parser'¶

GetEntries(parser_mediator, cookie_data=None, url=None, **kwargs)[source]¶

Extracts event objects from the cookie.

Parameters

parser_mediator (ParserMediator) – parser mediator.
cookie_data (str) – cookie data.
url (str) – URL or path where the cookie got set.

NAME = 'google_analytics_utma'¶

URLS = ['http://www.dfinews.com/articles/2012/02/google-analytics-cookies-and-forensic-implications']¶

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmbPlugin[source]¶

Bases: plaso.parsers.cookie_plugins.interface.BaseCookiePlugin

A browser cookie plugin for __utmb Google Analytics cookies.

The structure of the cookie data: <domain hash>.<pages viewed>.<unknown>.<last time>

For example: 137167072.1.10.1383170166 173272373.6.8.1440489514899 173272373.4.9.1373300660574

Or: <last time>

For example: 13113225820000000

COOKIE_NAME = '__utmb'¶

DESCRIPTION = 'Google Analytics utmb cookie parser'¶

GetEntries(parser_mediator, cookie_data=None, url=None, **kwargs)[source]¶

Extracts event objects from the cookie.

Parameters

parser_mediator (ParserMediator) – parser mediator.
cookie_data (bytes) – cookie data.
url (str) – URL or path where the cookie got set.

NAME = 'google_analytics_utmb'¶

URLS = ['http://www.dfinews.com/articles/2012/02/google-analytics-cookies-and-forensic-implications']¶

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmtPlugin[source]¶

Bases: plaso.parsers.cookie_plugins.interface.BaseCookiePlugin

A browser cookie plugin for __utmt Google Analytics cookies.

The structure of the cookie data: <last time>

For example: 13113215173000000

COOKIE_NAME = '__utmt'¶

DESCRIPTION = 'Google Analytics utmt cookie parser'¶

GetEntries(parser_mediator, cookie_data=None, url=None, **kwargs)[source]¶

Extracts event objects from the cookie.

Parameters

parser_mediator (ParserMediator) – parser mediator.
cookie_data (bytes) – cookie data.
url (str) – URL or path where the cookie got set.

NAME = 'google_analytics_utmt'¶

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmzPlugin[source]¶

Bases: plaso.parsers.cookie_plugins.interface.BaseCookiePlugin

A browser cookie plugin for __utmz Google Analytics cookies.

The structure of the cookie data: <domain hash>.<last time>.<sessions>.<sources>.<variables>

For example: 207318870.1383170190.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic| utmctr=(not%20provided)

Or: <last time>

For example: 13128990382000000

COOKIE_NAME = '__utmz'¶

DESCRIPTION = 'Google Analytics utmz cookie parser'¶

GetEntries(parser_mediator, cookie_data=None, url=None, **kwargs)[source]¶

Extracts event objects from the cookie.

Parameters

parser_mediator (ParserMediator) – parser mediator.
cookie_data (str) – cookie data.
url (str) – URL or path where the cookie got set.

NAME = 'google_analytics_utmz'¶

URLS = ['http://www.dfinews.com/articles/2012/02/google-analytics-cookies-and-forensic-implications']¶

plaso.parsers.cookie_plugins.interface module¶

This file contains an interface for browser cookie plugins.

class plaso.parsers.cookie_plugins.interface.BaseCookiePlugin[source]¶

Bases: plaso.parsers.plugins.BasePlugin

A browser cookie plugin for Plaso.

This is a generic cookie parsing interface that can handle parsing cookies from all browsers.

COOKIE_NAME = ''¶

DESCRIPTION = ''¶

GetEntries(parser_mediator, cookie_data=None, url=None, **kwargs)[source]¶

Extract and return EventObjects from the data structure.

Parameters

parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
cookie_data (Optional[bytes]) – cookie data, as a byte sequence.
url (Optional[str]) – URL or path where the cookie was set.

NAME = 'cookie'¶

Process(parser_mediator, cookie_name, cookie_data, url, **kwargs)[source]¶

Determine if this is the right plugin for this cookie.

Parameters

parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
cookie_name (str) – the name of the cookie value.
cookie_data (bytes) – the cookie data, as a byte sequence.
url (str) – the full URL or path where the cookie was set.

Raises

errors.WrongPlugin – If the cookie name differs from the one supplied in COOKIE_NAME.
ValueError – If cookie_name or cookie_data are not set.

plaso.parsers.cookie_plugins.manager module¶

The cookie plugins manager object.

class plaso.parsers.cookie_plugins.manager.CookiePluginsManager[source]¶

Bases: object

Class that implements the cookie plugins manager.

classmethod DeregisterPlugin(plugin_class)[source]¶

Deregisters a plugin class.

The plugin classes are identified based on their lower case name.

Parameters: plugin_class (type) – the class object of the plugin.
Raises: KeyError – if plugin class is not set for the corresponding name.

classmethod GetPlugins()[source]¶

Retrieves the cookie plugins.

Returns: list of all cookie plugin objects.
Return type: list[type]

classmethod RegisterPlugin(plugin_class)[source]¶

Registers a plugin class.

The plugin classes are identified based on their lower case name.

Parameters: plugin_class (type) – the class object of the plugin.
Raises: KeyError – if plugin class is already set for the corresponding name.

classmethod RegisterPlugins(plugin_classes)[source]¶

Registers plugin classes.

The plugin classes are identified based on their lower case name.

Parameters: plugin_classes (list[type]) – a list of class objects of the plugins.
Raises: KeyError – if plugin class is already set for the corresponding name.

Module contents¶

Imports for the cookies parser.