Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IIS parser: Added additional characters for cs(Cookie) field #4911

Merged
merged 4 commits into from
Oct 12, 2024
Merged

IIS parser: Added additional characters for cs(Cookie) field #4911

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d3a3260
IIS parser: Added additional characters for cs(Cookie) field
pyllyukko Oct 10, 2024
11b5c82
Update iis.py
joachimmetz Oct 12, 2024
b0e2b9f
Update iis.py
joachimmetz Oct 12, 2024
f0402b2
Update iis.py
joachimmetz Oct 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion plaso/parsers/text_plugins/iis.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,9 @@ class WinIISTextPlugin(interface.TextPlugin):
_UA = pyparsing.Word(
pyparsing.alphanums + _URI_SAFE_CHARACTERS + '[]') | _BLANK

_COOKIE = pyparsing.Word(
pyparsing.alphanums + _URI_SAFE_CHARACTERS + '@{}"\\') | _BLANK

# Per https://blogs.iis.net/nazim/use-of-special-characters-like-in-an-iis-url
# IIS does not require that a query comply with RFC1738 restrictions on valid
# URI characters
Expand Down Expand Up @@ -204,7 +207,7 @@ class WinIISTextPlugin(interface.TextPlugin):
_LOG_LINE_STRUCTURES['time-taken'] = _INTEGER.set_results_name('time_taken')
_LOG_LINE_STRUCTURES['cs-version'] = _URI.set_results_name('protocol_version')
_LOG_LINE_STRUCTURES['cs-host'] = _URI.set_results_name('cs_host')
_LOG_LINE_STRUCTURES['cs(Cookie)'] = _URI.set_results_name('cs_cookie')
_LOG_LINE_STRUCTURES['cs(Cookie)'] = _COOKIE.set_results_name('cs_cookie')
_LOG_LINE_STRUCTURES['cs(Referrer)'] = _URI.set_results_name('cs_referrer')
_LOG_LINE_STRUCTURES['cs(Referer)'] = _URI.set_results_name('cs_referrer')

Expand Down
7 changes: 7 additions & 0 deletions test_data/iis10_cookies.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#Date: 2021-04-01 00:00:21
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
2021-04-01 00:00:21 111.111.111.111 GET /foo/bar/baz.asp - 80 - 222.222.222.222 Mozilla/5.0+(Windows+NT+5.1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/35.0.2309.372+Safari/537.36 OutlookSession="{AAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}" http://111.111.111.111/ 200 0 0 65
2021-04-01 00:00:21 111.111.111.111 GET /foo/bar/baz.asp - 80 - 222.222.222.222 Mozilla/5.0+(Windows+NT+5.1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/35.0.2309.372+Safari/537.36 username=realm\user http://111.111.111.111/ 200 0 0 65
2021-04-01 00:00:21 111.111.111.111 GET /foo/bar/baz.asp - 80 - 222.222.222.222 Mozilla/5.0+(Windows+NT+5.1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/35.0.2309.372+Safari/537.36 username=realm@user http://111.111.111.111/ 200 0 0 65
18 changes: 18 additions & 0 deletions tests/parsers/text_plugins/iis.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,24 @@ def testProcessWithIIS10Log(self):
'recovery_warning')
self.assertEqual(number_of_warnings, 0)

def testProcessWithIIS10LogAndCookieField(self):
"""Tests the Process function with an IIS 10 log file and cs(Cookie)."""
plugin = iis.WinIISTextPlugin()
storage_writer = self._ParseTextFileWithPlugin(
['iis10_cookies.log'], plugin)

number_of_event_data = storage_writer.GetNumberOfAttributeContainers(
'event_data')
self.assertEqual(number_of_event_data, 3)

number_of_warnings = storage_writer.GetNumberOfAttributeContainers(
'extraction_warning')
self.assertEqual(number_of_warnings, 0)

number_of_warnings = storage_writer.GetNumberOfAttributeContainers(
'recovery_warning')
self.assertEqual(number_of_warnings, 0)


if __name__ == '__main__':
unittest.main()