Has anyone extended bro to retrieve the cookie name/value/attributes ?
I have added the var-extraction-cookies.bro and see names in the bro logs, but would like to capture the value/attributes.
Karl
Has anyone extended bro to retrieve the cookie name/value/attributes ?
Our contributed scripts repository [1] contains a script sidejack.bro,
which extracts cookies as you describe it. Essentially, you have to
perform two nested splits: one to get the key-value pairs and one to
separate keys from values.
Matthias