plaso.parsers.cookie_plugins package
Submodules
plaso.parsers.cookie_plugins.ganalytics module
This file contains a plugin for parsing Google Analytics cookies.
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmaEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Google analytics __utma cookie event data.
- cookie_name
name of cookie.
- Type
str
- domain_hash
domain hash.
- Type
str
- sessions
number of sessions.
- Type
int
- url
URL or path where the cookie got set.
- Type
str
- visited_times
dates and times the URL was visited.
- Type
list[dfdatetime.DateTimeValues]
- visitor_identifier
visitor identifier.
- Type
str
- DATA_TYPE = 'cookie:google:analytics:utma'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmaPlugin[source]
Bases:
BaseCookiePlugin
A browser cookie plugin for __utma Google Analytics cookies.
The structure of the cookie data: <domain hash>.<visitor ID>.<first visit>.<previous visit>.<last visit>. <number of sessions>
For example: 137167072.1215918423.1383170166.1383170166.1383170166.1
Or: <last visit>
For example: 13113225820000000
- COOKIE_NAME = '__utma'
- DATA_FORMAT = 'Google Analytics __utma cookie'
- NAME = 'google_analytics_utma'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmbEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Google analytics __utmb cookie event data.
- cookie_name
name of cookie.
- Type
str
- domain_hash
domain hash.
- Type
str
- last_visited_time
date and time the URL was last visited.
- Type
dfdatetime.DateTimeValues
- pages_viewed
number of pages viewed.
- Type
int
- url
URL or path where the cookie got set.
- Type
str
- DATA_TYPE = 'cookie:google:analytics:utmb'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmbPlugin[source]
Bases:
BaseCookiePlugin
A browser cookie plugin for __utmb Google Analytics cookies.
The structure of the cookie data: <domain hash>.<pages viewed>.<unknown>.<last time>
For example: 137167072.1.10.1383170166 173272373.6.8.1440489514899 173272373.4.9.1373300660574
Or: <last time>
For example: 13113225820000000
- COOKIE_NAME = '__utmb'
- DATA_FORMAT = 'Google Analytics __utmb cookie'
- NAME = 'google_analytics_utmb'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmtEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Google analytics __utmt cookie event data.
- cookie_name
name of cookie.
- Type
str
- last_visited_time
date and time the URL was last visited.
- Type
dfdatetime.DateTimeValues
- url
URL or path where the cookie got set.
- Type
str
- DATA_TYPE = 'cookie:google:analytics:utmt'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmtPlugin[source]
Bases:
BaseCookiePlugin
A browser cookie plugin for __utmt Google Analytics cookies.
The structure of the cookie data: <last time>
For example: 13113215173000000
- COOKIE_NAME = '__utmt'
- DATA_FORMAT = 'Google Analytics __utmt cookie'
- NAME = 'google_analytics_utmt'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmzEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Google analytics __utmz cookie event data.
- cookie_name
name of cookie.
- Type
str
- domain_hash
domain hash.
- Type
str
- last_visited_time
date and time the URL was last visited.
- Type
dfdatetime.DateTimeValues
- sessions
number of sessions.
- Type
int
- sources
number of sources.
- Type
int
- url
URL or path where the cookie got set.
- Type
str
- DATA_TYPE = 'cookie:google:analytics:utmz'
- class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmzPlugin[source]
Bases:
BaseCookiePlugin
A browser cookie plugin for __utmz Google Analytics cookies.
The structure of the cookie data: <domain hash>.<last time>.<sessions>.<sources>.<variables>
For example: 207318870.1383170190.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic| utmctr=(not%20provided)
Or: <last time>
For example: 13128990382000000
- COOKIE_NAME = '__utmz'
- DATA_FORMAT = 'Google Analytics __utmz cookie'
- NAME = 'google_analytics_utmz'
plaso.parsers.cookie_plugins.interface module
This file contains an interface for browser cookie plugins.
- class plaso.parsers.cookie_plugins.interface.BaseCookiePlugin[source]
Bases:
BasePlugin
A browser cookie plugin for Plaso.
This is a generic cookie parsing interface that can handle parsing cookies from all browsers.
- COOKIE_NAME = ''
- DATA_FORMAT = 'Browser cookie data'
- NAME = 'cookie_plugin'
- Process(parser_mediator, cookie_name, cookie_data, url, **kwargs)[source]
Extracts events from cookie data.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cookie_name (str) – the name of the cookie value.
cookie_data (bytes) – the cookie data, as a byte sequence.
url (str) – the full URL or path where the cookie was set.
- Raises
errors.WrongPlugin – If the cookie name differs from the one supplied in COOKIE_NAME.
ValueError – If cookie_name or cookie_data are not set.
plaso.parsers.cookie_plugins.manager module
The cookie plugins manager object.
- class plaso.parsers.cookie_plugins.manager.CookiePluginsManager[source]
Bases:
object
Class that implements the cookie plugins manager.
- classmethod DeregisterPlugin(plugin_class)[source]
Deregisters a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters
plugin_class (type) – the class object of the plugin.
- Raises
KeyError – if plugin class is not set for the corresponding name.
- classmethod GetPlugins()[source]
Retrieves the cookie plugins.
- Returns
list of all cookie plugin objects.
- Return type
list[type]
- classmethod RegisterPlugin(plugin_class)[source]
Registers a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters
plugin_class (type) – the class object of the plugin.
- Raises
KeyError – if plugin class is already set for the corresponding name.
- classmethod RegisterPlugins(plugin_classes)[source]
Registers plugin classes.
The plugin classes are identified based on their lower case name.
- Parameters
plugin_classes (list[type]) – a list of class objects of the plugins.
- Raises
KeyError – if plugin class is already set for the corresponding name.
Module contents
Imports for the cookies parser.