[Bro] Cookies

Matthias Vallentin vallentin at icir.org
Tue Sep 25 08:45:43 PDT 2012

> Has anyone extended bro to retrieve the cookie name/value/attributes ?

Our contributed scripts repository [1] contains a script sidejack.bro,
which extracts cookies as you describe it. Essentially, you have to
perform two nested splits: one to get the key-value pairs and one to
separate keys from values.


[1] http://git.bro-ids.org/bro-scripts.git/tree

More information about the Bro mailing list