🦙

Laurence Jones LaurenceJJones

🦙

@crowdsecurity Head Of Professional Services

LaurenceJJones / mongo.log

Last active June 1, 2022 19:59

Mongodb > 4.4 crowdsec parser WIP

	filter: "evt.Parsed.program == 'mongo'"
	onsuccess: next_stage
	name: crowdsecurity/myservice-logs
	description: "Mongodb4.4"
	debug: true
	nodes:
	- grok:
	pattern: '%{IPORHOST:remote_addr}:%{NUMBER}'
	expression: JsonExtract(evt.Line.Raw, "attr.remote")
	- grok:

LaurenceJJones / e_twint_fix.sh

Created January 16, 2022 13:55

twint elasticsearch fix

	!#/bin/bash
	#Replace with hostname / ip without port
	ELASTIC_URL="localhost"

	#Uncomment if twinttweets index exists in elastic
	#DISCLAIMER it will delete all indexed tweets
	#curl -XDELETE "$ELASTIC_URL:9200/twinttweets?pretty" -H 'Content-Type: application/json'

	curl -XPUT "$ELASTIC_URL:9200/twinttweets?pretty" -H 'Content-Type: application/json' -d '
	{

LaurenceJJones / docker-compose.yml

Created September 23, 2021 18:53

Nginx WAF Lab

	# This docker-compose file starts owasp/modsecurity-crs
	#
	# ATTENTION!
	# Some of the environment variables at the bottom of this
	# docker-compose.yaml file and TLS are only available
	# for self-built images based on Dockerfile-2.9-apache,
	# and only if build args SETTLS and SETPROXY were set during
	# the build of the parent owasp/modsecurity:2.9-apache image.

	# Disclaimer! Only expose any ports if you are in a controlled enviroment (Virtual machine on computer or server not exposed on the internet)

LaurenceJJones / unixcommands.txt

Last active September 20, 2021 21:00

List of commands on unix for testing in command injection