-
Notifications
You must be signed in to change notification settings - Fork 0
/
Analytics-cookie-regex_DROPEM.txt
209 lines (150 loc) · 6.29 KB
/
Analytics-cookie-regex_DROPEM.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
-----------------------===================:::::::::::::::: [ one nation:underground ] :::::::::::=============----------------------=
[*] Filename: Analytics-cookie-regex_DROPEM.txt
[*] Description: Around 50 of the most common tracking/analytics header/cookie names in regex format
[*] Why: If you are pentesting a target (esp w/o permission) - you want to do everything in your power to NOT raise alarms
If you have any experience with using automated scanners you already know its a careful balance between not taking 3 years
and not alerting the security team of your efforts. This came to mind while I was using Burp recently, evaluating paypal.com,
they were adding 5-7 key/value pairs and I realized after doing some quick math, that every single time I made a single request
to the target I was sending plenty of data about my (i would imagine very odd / obvious) hacking attempts to Bing, Google Tag mgr,
and Yandex analytics. Each of the values were at least 2-4 bytes, in addition to making my painfully obvious to the digital marketing
team, it was def. making my presense known, and this idea came to mind. Im sure its not unique, but I have never seen such a badass
list. These are ready to drop into Burp Suite - under Proxy / Settings / Match / Replace
[*] HOWTO: Take the raw list of regex payloads and save it to fuqtracking.txt - then import it into match replace (make sure you put it in the drop
cookie section. Since the remote server actaully defines and sets this tag and communuicates with these servers all we can do is try to
prevent it, or minimize what data gets sent . I also add 0.0.0.0 google-analytics.com , etc etc etc to my /etc/hosts file
[*] Created by: substance
[*] Created on: 4/4/24
[*] Last Mod: 4/4/24
[*] contact: nah
[*] affils: 9x
:: substance brings you a extremely comphrehensive list of spot on accurate regex's to match (and hopefully drop analytics headers in burp ::
-----------------------===================:::::::::::::::: [ one nation:underground ] :::::::::::=============----------------------
.-''-.
//'` `\|
_.._ '/' '|
.' .._| |' '|
| ' || /||
__| |__ _ _\'. .'/||
|__ __|| ' / |`--'` ||
| | .' | .' | ||
| | / | / | || />
| | | `'. | ||//
| | ' .'| '/ |'/ _..._
|_| `-' `--' |/ .---. .-'_..._''.
_..._ | | .--. .' .' '.\
.' '. | |.-. .- |__| / .'
. .-. . | | \ \ / / .| .--.. '
__ | ' ' | __ | | \ \ / / .' |_ | || |
.:--.'. | | | | .:--.'. | | \ \ / /.' || || | _
/ | \ | | | | |/ | \ | | | \ \ / /'--. .-'| |. ' .' |
`" __ | | | | | |`" __ | | | | \ ` / | | | | \ '. . . | /
.'.''| | | | | | .'.''| | | | \ / | | |__| '. `._____.-'/ .'.'| |//
/ / | |_| | | |/ / | |_'---' / / | '.' `-.______ /.'.'.-' /
\ \._,\ '/| | | |\ \._,\ '/ |`-' / | / ` .' \_.'
`--' `" '--' '--' `--' `" '..' `'-'
-----------------------===================:::::::::::::::: [ HACK TEH PLANET OR DIE TRYING ] :::::::::::=============----------------------
The best list of regular expressions (regex) for matching and potentially blocking cookies tracking and analytics based on cookie names. These regex patterns can be imported into Burp Suite for its matching rules to drop or manipulate requests containing these cookies.
Key:
[-] Questionable, maybe avoid it it might not be analytics
__gsas
Regex: __gsas=.*?;
__gpi
Regex: __gpi=.*?;
__gpi_optout
Regex: __gpi_optout=.*?;
NID
Regex: NID=.*?;
DSID
Regex: DSID=.*?;
test_cookie
Regex: test_cookie=.*?;
[-] id
Regex: id=.*?;
__gads
Regex: __gads=.*?;
GED_PLAYLIST_ACTIVITY
Regex: GED_PLAYLIST_ACTIVITY=.*?;
'ACLK_DATA
Regex: ACLK_DATA=.*?;
m_sess
Regex: pm_sess=.*?;
pm_sess_NNN
Regex: pm_sess_NNN=.*?;
aboutads_sessNNN
Regex: aboutads_sessNNN=.*?;
FPAU
Regex: FPAU=.*?;
ANID
Regex: ANID=.*?;
AID
Regex: AID=.*?;
IDE
Regex: IDE=.*?;
TAID
Regex: TAID=.*?;
FPGCLDC
Regex: FPGCLDC=.*?;
_gcl_dc
Regex: _gcl_dc=.*?;
_gcl_au
Regex: _gcl_au=.*?;
FLC
Regex: FLC=.*?;
RUL
Regex: RUL=.*?;
FCCDCF
Regex: FCCDCF=.*?;
FCNEC
Regex: FCNEC=.*?;
FPGCLAW
Regex: FPGCLAW=.*?;
FPGCLGB
Regex: FPGCLGB=.*?;
_gcl_gb
Regex: _gcl_gb=.*?;
gac_gb<wpid>
Regex: _gac_gb_.*?=.*?;
_gcl_aw
Regex: _gcl_aw=.*?;
1P_JAR
Regex: 1P_JAR=.*?;
Conversion
Regex: Conversion=.*?;
YSC
Regex: YSC=.*?;
VISITOR_INFO1_LIVE
Regex: VISITOR_INFO1_LIVE=.*?;
_ga
Regex: _ga=.*?;
_gid
Regex: _gid=.*?;
gat[<customname>]
Regex: _gat_.*?=.*?;
__utma
Regex: __utma=.*?;
__utmb
Regex: __utmb=.*?;
__utmc
Regex: __utmc=.*?;
__utmt
Regex: __utmt=.*?;
__utmz
Regex: __utmz=.*?;
__utmv
Regex: __utmv=.*?;
AMP_TOKEN
Regex: AMP_TOKEN=.*?;
FPID
Regex: FPID=.*?;
GA_OPT_OUT
Regex: GA_OPT_OUT=.*?;
ga<wpid>
Regex: _ga_.*?=.*?;
dc_gtm<property-id>
Regex: _dc_gtm_.*?=.*?;
_gaexp
Regex: _gaexp=.*?;
_gaexp_rc
Regex: _gaexp_rc=.*?;
Each regex pattern follows the format of cookie_name=.*?;, which matches the cookie name followed by any content until the next semicolon (;),
denoting the end of the cookie value in the HTTP header.