Skip to content

Instantly share code, notes, and snippets.

View aeppert's full-sized avatar

Aaron Eppert aeppert

View GitHub Profile
@prehensile
prehensile / prehensile.networkwatcher.plist
Created November 14, 2010 04:41
A launchd daemon to execute a Python script when network configuration changes.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>prehensile.networkwatcher</string>
<key>ProgramArguments</key>
<array>
<string>/usr/bin/python</string>
@gregglind
gregglind / fabfile.py
Created September 9, 2011 16:59
Fabfile for PyMNtos September 2011 Meeting
#!/usr/bin/env python
"""
Example fabfile for PyMNtos September 2011 meeting.
some examples of usage:
$ fab -H somehost -- uname -a
$ fab -H somehost run:'uname -a'
$ fab -d example
@zbroyar
zbroyar / gist:1432555
Created December 5, 2011 06:28
OCaml CURL GET, POST, PUT, DELETE examples
(* ocamlfind ocamlopt -o exmpl -package curl -linkpkg exmpl.ml *)
open Printf
let _ = Curl.global_init Curl.CURLINIT_GLOBALALL
(*
*************************************************************************
** Aux. functions
*************************************************************************
*)
@mavam
mavam / bro-customization.md
Last active July 27, 2020 02:14
Bro script-level customization points.

General

# Process packets despite bad checksums.
redef ignore_checksums = T;

File Analysis

This will change significantly with Bro 2.2 when we have the file analysis

@sethhall
sethhall / myextract.bro
Last active February 17, 2020 03:27
File extraction special naming example.
redef record fa_file += {
is_my_extractor_going: bool &default=F;
};
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( !f$is_my_extractor_going )
{
f$is_my_extractor_going=T;
if ( f$source == "HTTP" && is_orig == F )
@sethhall
sethhall / myextract-with-domain.bro
Created January 2, 2014 16:20
Example for Bro file extraction with domain name in the filename if the file was grabbed over HTTP.
redef record fa_file += {
is_my_extractor_going: bool &default=F;
};
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( !f$is_my_extractor_going )
{
f$is_my_extractor_going=T;
if ( f$source == "HTTP" && is_orig == F )
@ork
ork / parseoui.awk
Last active February 20, 2022 23:17
Parse IEEE OUI vendor list to JSON
#!/usr/bin/awk -f
# Parse IEEE OUI vendor list to JSON
# http://standards.ieee.org/develop/regauth/oui/oui.txt
# ---
# Usage:
# $ chmod +x parseoui.awk
# $ wget http://standards.ieee.org/develop/regauth/oui/oui.txt
# $ ./parseoui.awk oui.txt > oui.json
BEGIN {
@sethhall
sethhall / http-add-post-to-log.bro
Created May 9, 2014 16:23
Add HTTP POST to http.log
redef record HTTP::Info += {
post_body: string &optional &log;
};
redef record fa_file += {
http_log: HTTP::Info &optional;
};
event http_get_post_body(f: fa_file, data: string)
##! Add the peer to the connection logs.
module Conn;
export {
redef record Conn::Info += {
peer: string &optional &log;
};
}
@nick123pig
nick123pig / readme.md
Last active April 10, 2019 15:13
Dashing Table

dashing-table

Allows you to use tables with the dashing framework.

Preview

Basic Table Preview