mirror of
https://github.com/Velocidex/velociraptor.git
synced 2026-10-12 02:09:59 +00:00
Abdelghafour Bouhdyd
ddc2eb9650
### Problem
Since Chrome 96 (November 2021), the cookie database is stored in
`<profile>\Network\Cookies` instead of `<profile>\Cookies`. The default
glob in `Windows.Applications.Chrome.Cookies` only matched the old
location:
\AppData\Local\Google\Chrome\User Data\*\Cookies
On any current Chrome install the artifact matches no files and returns
zero rows, without an error. The output also had no user or file path,
so on shared machines cookies couldn't be traced to a user or profile.
### Changes
- **Glob:** search both `Network\Cookies` and the old `Cookies`
location, so old and new browser versions are covered.
- **Browsers:** also search Edge, Brave and Vivaldi, which use the same
profile layout. `Windows.Applications.Chrome.History` already covers
these.
- **Columns:** add `User` and `OSPath`.
- **Description:** mention the new location and the supported browsers.
New default glob:
\AppData\Local\{Google\Chrome,Microsoft\Edge,BraveSoftware\Brave-Browser,Vivaldi}\User
Data\*\{Network\Cookies,Cookies}