David Vassallo dvas0004
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| tcp { | |
| port => 5140 | |
| type => "windows-events" |
dvas0004
/ embeddedTLSserver.go
Created
June 17, 2015 13:05
Example of Golang embedding, see http://blog.davidvassallo.me/?p=1650
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "io" | |
| "net/http" | |
| "log" | |
| "crypto/tls" | |
| "net" | |
| "sixpmplc.com/golang/license_server/tls_common" | |
| ) |
dvas0004
/ tls_common
Last active
August 29, 2015 14:23
tls_common - certificate and key for embedded TLS server, see http://blog.davidvassallo.me/?p=1650
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package tls_common | |
| /* | |
| IMPORTANT: due to golang's encapsulation directives, variables in this file MUST start with a capital letter, else | |
| they will not be visible from other packages | |
| reference: http://golangtutorials.blogspot.com/2011/06/structs-in-go-instead-of-classes-in.html | |
| */ | |
| /* |
dvas0004
/ logging_dynamic_template.json
Created
June 25, 2015 09:59
modified default dynamic template for log analysis to be used by logstash (http://blog.davidvassallo.me/?p=1658)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "template" : "logstash-*", | |
| "settings" : { | |
| "analysis": { | |
| "analyzer": { | |
| "custom_keyword": { | |
| "filter": ["lowercase"], | |
| "type": "keyword" | |
| } | |
| } |
dvas0004
/ nxlog.conf
Created
June 28, 2015 12:28
NXLog AlienVault OSSIM configuration (http://blog.davidvassallo.me/?p=1664)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| define ROOT /nxlog | |
| Moduledir /usr/local/libexec/nxlog/modules | |
| CacheDir %ROOT%/data | |
| Pidfile %ROOT%/data/nxlog.pid | |
| SpoolDir %ROOT%/data | |
| LogFile %ROOT%/data/nxlog.log | |
| <Extension _syslog> | |
| Module xm_syslog |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Global directives # | |
| ######################################## | |
| User nxlog | |
| Group nxlog | |
| LogFile /var/log/nxlog/nxlog.log | |
| LogLevel INFO | |
| ######################################## | |
| # Modules # |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| tcp { | |
| port => 5142 | |
| type => "ossim-events" | |
| codec => json { | |
| charset => "CP1252" | |
| } |
dvas0004
/ gist:d600a65f474f6d313251
Created
June 28, 2015 12:50
Manual OSSIM GROK log parsing (legacy)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ######## ALIENVAULT OSSIM Logs ######################################## | |
| if [type] == "ossim-events" { | |
| grok { | |
| patterns_dir => "/elk/logstash-1.5.1/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.1.10/patterns" | |
| match => [ "message", "<entry id='%{INT:entry_id}' v='%{INT:v}' fdate='%{FDATE:fdate}' date='%{NUMBER:unix_timestamp}' plugin_id='%{NUMBER:plugin_id}' sensor='%{IP:sensor}' src_ip='%{IP:src_ip}' dst_ip='%{IP:dst_ip}' src_port='%{NUMBER:src_port}' dst_port='%{NUMBER:dst_port}' tzone='%{NUMBER:tzone}' datalen='%{NUMBER:datalen}' data='%{GREEDYDATA:data}' plugin_sid='%{NUMBER:plugin_sid}' proto='%{NUMBER:proto}' ctx='%{GREEDYDATA:ctx}' src_host='%{GREEDYDATA:src_host}' dst_host='%{GREEDYDATA:dst_host}' src_net='%{GREEDYDATA:src_net}' dst_net='%{GREEDYDATA:dst_net}' username='%{GREEDYDATA:username}' userdata1=%{GREEDYDATA:userdata}' idm_host_src='%{GREEDYDATA:idm_host_src}' idm_host_dst='%{GREEDYDATA:idm_host_dst}' idm_mac_src='%{MAC:idm_mac_src}' idm_ma |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package com.sixpmplc.ble_demo; | |
| import android.annotation.TargetApi; | |
| import android.app.Activity; | |
| import android.bluetooth.BluetoothAdapter; | |
| import android.bluetooth.BluetoothDevice; | |
| import android.bluetooth.BluetoothGatt; | |
| import android.bluetooth.BluetoothGattCallback; | |
| import android.bluetooth.BluetoothGattCharacteristic; | |
| import android.bluetooth.BluetoothGattDescriptor; |
dvas0004
/ uol_forensics.c
Created
September 7, 2015 07:32
Practice reverse engineering simple C programs for forensics
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <stdio.h> | |
| int main() | |
| { | |
| char password[13]; | |
| printf("What's the password? "); | |
| fgets(password,13,stdin); | |