plaso.parsers.cookie_plugins package¶
Submodules¶
plaso.parsers.cookie_plugins.ganalytics module¶
This file contains a plugin for parsing Google Analytics cookies.
Bases:
plaso.containers.events.EventData
Google Analytics event data.
str – name of cookie.
str – domain hash.
int – number of pages viewed.
int – number of sessions.
int – number of sources.
str – URL or path where the cookie got set.
str – visitor identifier.
Bases:
plaso.parsers.cookie_plugins.interface.BaseCookiePlugin
A browser cookie plugin for __utma Google Analytics cookies.
The structure of the cookie data: <domain hash>.<visitor ID>.<first visit>.<previous visit>.<last visit>. <number of sessions>
For example: 137167072.1215918423.1383170166.1383170166.1383170166.1
Or: <last visit>
For example: 13113225820000000
Extracts event objects from the cookie.
Parameters: - parser_mediator (ParserMediator) – parser mediator.
- cookie_data (str) – cookie data.
- url (str) – URL or path where the cookie got set.
Bases:
plaso.parsers.cookie_plugins.interface.BaseCookiePlugin
A browser cookie plugin for __utmb Google Analytics cookies.
The structure of the cookie data: <domain hash>.<pages viewed>.<unknown>.<last time>
For example: 137167072.1.10.1383170166 173272373.6.8.1440489514899 173272373.4.9.1373300660574
Or: <last time>
For example: 13113225820000000
Extracts event objects from the cookie.
Parameters: - parser_mediator (ParserMediator) – parser mediator.
- cookie_data (bytes) – cookie data.
- url (str) – URL or path where the cookie got set.
Bases:
plaso.parsers.cookie_plugins.interface.BaseCookiePlugin
A browser cookie plugin for __utmt Google Analytics cookies.
The structure of the cookie data: <last time>
For example: 13113215173000000
Extracts event objects from the cookie.
Parameters: - parser_mediator (ParserMediator) – parser mediator.
- cookie_data (bytes) – cookie data.
- url (str) – URL or path where the cookie got set.
Bases:
plaso.parsers.cookie_plugins.interface.BaseCookiePlugin
A browser cookie plugin for __utmz Google Analytics cookies.
The structure of the cookie data: <domain hash>.<last time>.<sessions>.<sources>.<variables>
For example: 207318870.1383170190.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic| utmctr=(not%20provided)
Or: <last time>
For example: 13128990382000000
Extracts event objects from the cookie.
Parameters: - parser_mediator (ParserMediator) – parser mediator.
- cookie_data (str) – cookie data.
- url (str) – URL or path where the cookie got set.
plaso.parsers.cookie_plugins.interface module¶
This file contains an interface for browser cookie plugins.
Bases:
plaso.parsers.plugins.BasePlugin
A browser cookie plugin for Plaso.
This is a generic cookie parsing interface that can handle parsing cookies from all browsers.
Extract and return EventObjects from the data structure.
Parameters: - parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
- cookie_data (Optional[bytes]) – cookie data, as a byte sequence.
- url (Optional[str]) – URL or path where the cookie was set.
Determine if this is the right plugin for this cookie.
Parameters: - parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
- cookie_name (str) – the name of the cookie value.
- cookie_data (bytes) – the cookie data, as a byte sequence.
- url (str) – the full URL or path where the cookie was set.
Raises: errors.WrongPlugin
– If the cookie name differs from the one supplied in COOKIE_NAME.ValueError
– If cookie_name or cookie_data are not set.
plaso.parsers.cookie_plugins.manager module¶
The cookie plugins manager object.
Bases:
object
Class that implements the cookie plugins manager.
Deregisters a plugin class.
The plugin classes are identified based on their lower case name.
Parameters: plugin_class (type) – the class object of the plugin. Raises: KeyError
– if plugin class is not set for the corresponding name.
Retrieves the cookie plugins.
Returns: list of all cookie plugin objects. Return type: list[type]
Registers a plugin class.
The plugin classes are identified based on their lower case name.
Parameters: plugin_class (type) – the class object of the plugin. Raises: KeyError
– if plugin class is already set for the corresponding name.
Registers plugin classes.
The plugin classes are identified based on their lower case name.
Parameters: plugin_classes (list[type]) – a list of class objects of the plugins. Raises: KeyError
– if plugin class is already set for the corresponding name.
Module contents¶
Imports for the cookies parser.