> Has anyone extended bro to retrieve the cookie name/value/attributes ?
Our contributed scripts repository [1] contains a script sidejack.bro,
which extracts cookies as you describe it. Essentially, you have to
perform two nested splits: one to get the key-value pairs and one to
separate keys from values.
Matthias
[1] http://git.bro-ids.org/bro-scripts.git/tree