~/Library/Cookies/Cookies.binarycookies
.
The file is a binary file so examining its contents with a text
editor or cat
won't allow you determine what cookies are stored on the system by
Safari. However, you can use the BinaryCookieReader
Python script provided at
Safari/iOS – Cookies.binarycookies reader to view Safari cookies.
If you run the script with no arguments given to it on the command line, you will see the following message regarding usage of the script:
$ python BinaryCookieReader.py Usage: Python BinaryCookieReader.py [Full path to Cookies.binarycookies file] Example: Python BinaryCookieReader.py C:\Cookies.binarycookies $
To view the cookies stored by Safari on an OS X system, you can use
the command python BinaryCookieReader.py
~/Library/Cookies/Cookies.binarycookies
. When I ran the command on
a MacBook Pro laptop, I saw details for a long list of cookies, some of
which are shown below:
$ python BinaryCookieReader.py ~/Library/Cookies/Cookies.binarycookies #*************************************************************************# # BinaryCookieReader: developed by Satishb3: http://www.securitylearn.net # #*************************************************************************# Cookie : WMF-Last-Access=01-Jul-2016; domain=www.wikipedia.org; path=/; expires= Tue, 02 Aug 2016; Secure; HttpOnly Cookie : DSID=ADyxuktRDWVUhSyKFh_6YKD1DQDp7uQgOaj-ZHRJpB9Q9wQkf2PJ41wfDp-OCo7TTZ 44Cn-EgGjDgDX698pX7PtRGDzfilM_532VqrHwSBZKlXoSMC7UVxo; domain=.doubleclick.net; path=/; expires=Wed, 13 Jul 2016; HttpOnly Cookie : FLC=CMH0JBD2mZ8_GNv_pZEBKK3kbDDoiNu7AQ; domain=.doubleclick.net; path=/ ; expires=Fri, 01 Jul 2016; Cookie : id=22a355925a080057||t=1467168875|et=730|cs=002213fd48818175d2d85aea1f; domain=.doubleclick.net; path=/; expires=Fri, 29 Jun 2018; Cookie : IDE=AHWqTUmv9KBdHpYX49KJqNzQ9cVuEYbYmpZ9joD_yaslBVTEou4wL6A1XB; domain= .doubleclick.net; path=/; expires=Fri, 29 Jun 2018; HttpOnly Cookie : __gads=ID=d3e07f9e0e03ae29:T=1466956034:S=ALNI_MbaiEoRM_RyC5OauKUBIeoJe -rOnw; domain=.w3schools.com; path=/; expires=Tue, 26 Jun 2018;
If I just want to see the domain names for all of the cokies stored by
Safari, I can pipe the output through
grep to extract the "domain=" portion of a cookie's entry, e.g.,
domain=.doubleclick.net;
, then pipe the output of the grep
command into cut to
eliminate the "domain=" portion of the lines by using the equals sign as a
delimiter, then use cut again to eliminate the semicolon at the end of each
line and then use sed to
eliminate the period at the beginning of some lines, such as
.w3schools.com
. I can then pipe that output into
sort to sort the results
alphabetically and then pipe the output into
uniq to eliminate duplicate
entries associated with a domain storing multiple cookies and entries where
the domain name appears with and without a leading period, e.g.
.arstechnica.com
and arstechnica.com
.
$ python BinaryCookieReader.py ~/Library/Cookies/Cookies.binarycookies | grep -E -o "domain=.*?;" | cut -d"=" -f2 | cut -d";" -f1 | sed 's/^\.//' | sort | uniq ^filecookies^ accounts.google.com accounts.justia.com ads.linkedin.com akamai.com allstate.com amazon.com apple.com appsliced.co arstechnica.com atdmt.com att.com <text snipped> www.w3schools.com www.weonlydo.com www.whatismyip.com www.wikipedia.org yelp.com youtube.com zemanta.com
The atdmt entry represents a tracking cookie associated with the Facebook subsidiary Atlas Solutions; the cookie originates from the domain atdmt.com, but is used as a third-party cookie by several other websites.
The script will allow you to view all cookies stored by Safari. If, instead, you just want to see the cookies stored while visiting a particular webpage, you can, with the web page open in a Safari tab, take the steps listed in Viewing cookies stored by a web page in Safari.
Download script:
SecurityLearn (developer's site)
MoonPoint
Support