Retrieve ALL cookies from Internet Explorer

Try to retrieve IE cookies from shell:cookies folder. There is the below code as an example:

Option ExplicitSub GetIECookies()    Dim sCookiesPath As String    Dim oCookies As Object    Dim oFSO As Object    Dim oFolder As Object    Dim oFile    Dim sContent As String    Dim a() As String    Dim i As Long    Dim aItems    Dim aCookies()    ' read IE cookie files    sCookiesPath = CreateObject("shell.application").Namespace("shell:Cookies").self.Path    Set oCookies = CreateObject("Scripting.Dictionary")    Set oFSO = CreateObject("Scripting.FileSystemObject")    Set oFolder = oFSO.GetFolder(sCookiesPath)    For Each oFile In oFolder.Files        If LCase(oFSO.GetExtensionName(oFile.Name)) = "txt" Then            With oFile.OpenAsTextStream(1, 0) ' read-only, ascii                sContent = .ReadAll                .Close            End With            sContent = Replace(sContent, vbCr, "")            ' split cookies within file            a = Split(sContent, vbLf & "*" & vbLf)            For i = 0 To UBound(a) - 1                oCookies.Add oCookies.Count, a(i)            Next        End If    Next    ' parse data, repack to 2d array    aItems = oCookies.Items()    If UBound(aItems) = -1 Then        MsgBox "No cookies found"    Else        ReDim aCookies(1 To UBound(aItems) + 1, 1 To 6)        For i = 1 To UBound(aItems) + 1            a = Split(aItems(i - 1), vbLf)            aCookies(i, 1) = a(0)            aCookies(i, 2) = a(1)            aCookies(i, 3) = a(2)            aCookies(i, 4) = GetInetCookieFlags(a(3))            aCookies(i, 5) = ConvDT(a(4), a(5))            aCookies(i, 6) = ConvDT(a(6), a(7))        Next        ' output        With ThisWorkbook.Sheets(1)            .Cells.Delete            .Range("A1:F1") = Array("Name", "Value", "Host/Path", "Flags", "Expiration", "Created")            Output .Range("A2"), aCookies        End With    End IfEnd SubFunction ConvDT(sLowNTFmt As String, sHighNTFmt As String) As Date    Dim dNTFmt As Double    Dim dUnixFmt As Double    ' FILETIME format is the number of 100 nanosecond ticks since 00:00 1 Jan, 1601 (UTC).    dNTFmt = sHighNTFmt * 4294967296# + sLowNTFmt    ' Unix time format is the number of seconds since 00:00 1 Jan 1970    dUnixFmt = 0.0000001 * dNTFmt - 11644473600#    ' VB time format is the number of days since 00:00 1 Jan 1900    ConvDT = CDate(dUnixFmt / 86400 + 25569)End FunctionFunction GetInetCookieFlags(sFlags As String) As String    Dim lFlags As Long    Dim aFlag    ' reset bit 32 to avoid overflow    If sFlags >= 2147483648# Then lFlags = CLng(sFlags - 2147483648#) Else lFlags = CLng(sFlags)    ' convert flags bits to string representation    With CreateObject("Scripting.Dictionary")        For Each aFlag In Array( _            Array(&H1, "IS SECURE"), _            Array(&H2, "IS SESSION"), _            Array(&H10, "THIRD PARTY"), _            Array(&H20, "PROMPT REQUIRED"), _            Array(&H40, "EVALUATE P3P"), _            Array(&H80, "APPLY P3P"), _            Array(&H100, "P3P ENABLED"), _            Array(&H200, "IS RESTRICTED"), _            Array(&H400, "IE6"), _            Array(&H800, "IS LEGACY"), _            Array(&H1000, "NON SCRIPT"), _            Array(&H2000, "HTTPONLY"), _            Array(&H4000, "HOST ONLY"), _            Array(&H8000, "APPLY HOST ONLY"), _            Array(&H20000, "RESTRICTED ZONE"), _            Array(&H20000000, "ALL COOKIES"), _            Array(&H40000000, "NO CALLBACK"), _            Array(&H80000000, "ECTX 3RDPARTY") _        )            If lFlags And aFlag(0) Then .Add .Count, aFlag(1)        Next        GetInetCookieFlags = Join(.Items(), vbCrLf)    End WithEnd FunctionSub Output(oDstRng As Range, aCells As Variant)    With oDstRng        .Parent.Select        With .Resize( _            UBound(aCells, 1) - LBound(aCells, 1) + 1, _            UBound(aCells, 2) - LBound(aCells, 2) + 1 _        )            .NumberFormat = "@"            .Value = aCells            .Columns.AutoFit        End With    End WithEnd Sub

The output for me after deleting all cookies and navigating to https://stackoverflow.com/ is as follows:

Some notes regarding the code.

It parses files in Cookies\ folder only, but not in Cookies\Low\ which is for applications running under low privileges. It retrieves persistent cookies stored in the folder only, but not session cookies, which are stored in memory and can be accessed only by the process that created them. Time is in UTC.

The structure of a cookie within a file is as follows:

Cookie nameCookie valueHost/path for the web server setting the cookieFlagsExirpation time (low)Expiration time (high)Creation time (low)Creation time (high)Record delimiter (*)

Flags are defined as per wininet.dll headers:

#define INTERNET_COOKIE_IS_SECURE                0x00000001#define INTERNET_COOKIE_IS_SESSION               0x00000002#define INTERNET_COOKIE_THIRD_PARTY              0x00000010#define INTERNET_COOKIE_PROMPT_REQUIRED          0x00000020#define INTERNET_COOKIE_EVALUATE_P3P             0x00000040#define INTERNET_COOKIE_APPLY_P3P                0x00000080#define INTERNET_COOKIE_P3P_ENABLED              0x00000100#define INTERNET_COOKIE_IS_RESTRICTED            0x00000200#define INTERNET_COOKIE_IE6                      0x00000400#define INTERNET_COOKIE_IS_LEGACY                0x00000800#define INTERNET_COOKIE_NON_SCRIPT               0x00001000#define INTERNET_COOKIE_HTTPONLY                 0x00002000#define INTERNET_COOKIE_HOST_ONLY                0x00004000#define INTERNET_COOKIE_APPLY_HOST_ONLY          0x00008000#define INTERNET_COOKIE_RESTRICTED_ZONE          0x00020000#define INTERNET_COOKIE_ALL_COOKIES              0x20000000#define INTERNET_COOKIE_NO_CALLBACK              0x40000000#define INTERNET_COOKIE_ECTX_3RDPARTY            0x80000000