plaso.parsers.cookie_plugins package

Submodules

plaso.parsers.cookie_plugins.ganalytics module

This file contains a plugin for parsing Google Analytics cookies.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmaEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Google analytics __utma cookie event data.

cookie_name

name of cookie.

Type:: str

domain_hash

domain hash.

Type:: str

sessions

number of sessions.

Type:: int

url

URL or path where the cookie got set.

Type:: str

visited_times

dates and times the URL was visited.

Type:: list[dfdatetime.DateTimeValues]

visitor_identifier

visitor identifier.

Type:: str

DATA_TYPE = 'cookie:google:analytics:utma'

__init__()[source]: Initializes event data.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmaPlugin[source]

Bases: BaseCookiePlugin

A browser cookie plugin for __utma Google Analytics cookies.

The structure of the cookie data: <domain hash>.<visitor ID>.<first visit>.<previous visit>.<last visit>. <number of sessions>

For example: 137167072.1215918423.1383170166.1383170166.1383170166.1

Or: <last visit>

For example: 13113225820000000

COOKIE_NAME = '__utma'

DATA_FORMAT = 'Google Analytics __utma cookie'

NAME = 'google_analytics_utma'

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmbEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Google analytics __utmb cookie event data.

cookie_name

name of cookie.

Type:: str

domain_hash

domain hash.

Type:: str

last_visited_time

date and time the URL was last visited.

Type:: dfdatetime.DateTimeValues

pages_viewed

number of pages viewed.

Type:: int

url

URL or path where the cookie got set.

Type:: str

DATA_TYPE = 'cookie:google:analytics:utmb'

__init__()[source]: Initializes event data.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmbPlugin[source]

Bases: BaseCookiePlugin

A browser cookie plugin for __utmb Google Analytics cookies.

The structure of the cookie data: <domain hash>.<pages viewed>.<unknown>.<last time>

For example: 137167072.1.10.1383170166 173272373.6.8.1440489514899 173272373.4.9.1373300660574

Or: <last time>

For example: 13113225820000000

COOKIE_NAME = '__utmb'

DATA_FORMAT = 'Google Analytics __utmb cookie'

NAME = 'google_analytics_utmb'

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmtEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Google analytics __utmt cookie event data.

cookie_name

name of cookie.

Type:: str

last_visited_time

date and time the URL was last visited.

Type:: dfdatetime.DateTimeValues

url

URL or path where the cookie got set.

Type:: str

DATA_TYPE = 'cookie:google:analytics:utmt'

__init__()[source]: Initializes event data.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmtPlugin[source]

Bases: BaseCookiePlugin

A browser cookie plugin for __utmt Google Analytics cookies.

The structure of the cookie data: <last time>

For example: 13113215173000000

COOKIE_NAME = '__utmt'

DATA_FORMAT = 'Google Analytics __utmt cookie'

NAME = 'google_analytics_utmt'

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmzEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Google analytics __utmz cookie event data.

cookie_name

name of cookie.

Type:: str

domain_hash

domain hash.

Type:: str

last_visited_time

date and time the URL was last visited.

Type:: dfdatetime.DateTimeValues

sessions

number of sessions.

Type:: int

sources

number of sources.

Type:: int

url

URL or path where the cookie got set.

Type:: str

DATA_TYPE = 'cookie:google:analytics:utmz'

__init__()[source]: Initializes event data.

class plaso.parsers.cookie_plugins.ganalytics.GoogleAnalyticsUtmzPlugin[source]

Bases: BaseCookiePlugin

A browser cookie plugin for __utmz Google Analytics cookies.

The structure of the cookie data: <domain hash>.<last time>.<sessions>.<sources>.<variables>

For example: 207318870.1383170190.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic| utmctr=(not%20provided)

Or: <last time>

For example: 13128990382000000

COOKIE_NAME = '__utmz'

DATA_FORMAT = 'Google Analytics __utmz cookie'

NAME = 'google_analytics_utmz'

plaso.parsers.cookie_plugins.interface module

This file contains an interface for browser cookie plugins.

class plaso.parsers.cookie_plugins.interface.BaseCookiePlugin[source]

Bases: BasePlugin

A browser cookie plugin for Plaso.

This is a generic cookie parsing interface that can handle parsing cookies from all browsers.

COOKIE_NAME = ''

DATA_FORMAT = 'Browser cookie data'

NAME = 'cookie_plugin'

Process(parser_mediator, cookie_name, cookie_data, url, **kwargs)[source]

Extracts events from cookie data.

Parameters:

parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cookie_name (str) – the name of the cookie value.
cookie_data (bytes) – the cookie data, as a byte sequence.
url (str) – the full URL or path where the cookie was set.

Raises:

errors.WrongPlugin – If the cookie name differs from the one supplied in COOKIE_NAME.
ValueError – If cookie_name or cookie_data are not set.

plaso.parsers.cookie_plugins.manager module

The cookie plugins manager object.

class plaso.parsers.cookie_plugins.manager.CookiePluginsManager[source]

Bases: object

Class that implements the cookie plugins manager.

classmethod DeregisterPlugin(plugin_class)[source]

Deregisters a plugin class.

The plugin classes are identified based on their lower case name.

Parameters:: plugin_class (type) – the class object of the plugin.
Raises:: KeyError – if plugin class is not set for the corresponding name.

classmethod GetPlugins()[source]

Retrieves the cookie plugins.

Returns:: list of all cookie plugin objects.
Return type:: list[type]

classmethod RegisterPlugin(plugin_class)[source]

Registers a plugin class.

The plugin classes are identified based on their lower case name.

Parameters:: plugin_class (type) – the class object of the plugin.
Raises:: KeyError – if plugin class is already set for the corresponding name.

classmethod RegisterPlugins(plugin_classes)[source]

Registers plugin classes.

The plugin classes are identified based on their lower case name.

Parameters:: plugin_classes (list[type]) – a list of class objects of the plugins.
Raises:: KeyError – if plugin class is already set for the corresponding name.

Module contents

Imports for the cookies parser.