grigorescu

local msg_types = {
   [0] = "None",
   [1] = "Version",
   [2] = "Serial",
   [3] = "Close",
   [4] = "Close all",
   [5] = "Error",
   [6] = "Connect to",
   [7] = "Connected",
   [8] = "Request events",

grigorescu

##! Analysis of ARP Traffic.
##! This script logs ARP traffic while doing so builds an internal ARP cache
##! that can be used to determine when MAC/IP associations change.
##!
##! Written by Peter Erickson <[email protected]>
##! Reference: http://mailman.icsi.berkeley.edu/pipermail/bro/2011-November/004415.html
#
# Abbreviations are taken from RFC 826:
#
# SHA: source hardware address (i.e., MAC address)

grigorescu

#!/bin/bash
#
# Found on: http://hackforums.net/showthread.php?tid=914128
#
#Autorooter and backdoor bash-script
#Hopefully this script will come to good use
#Run n tell dat home, home, homeboy!!
#by: ludwig @ SSTeam.info
clear

grigorescu

breakpoint_to_pcap

Overview

Given an input PCAP and a location in a Bro script, this script will filter the PCAP into a new file, which contains only the connections that visited that script location. This script can help filter a large PCAP to narrow down problematic connections, such as protocol violations, weirds, etc.

Example

grigorescu

#!/usr/bin/python

import sys
import pygeoip
import dns.resolver
from IPy import IP
import pytz
import smtplib
import datetime

grigorescu

#!/usr/bin/python

import argparse, sys

def hexdump(text, space=False):
    result = ""
    for t in text:
        s = str(hex(ord(t))).replace('0x', '')
        if len(s) == 1:
            s = '0' + s

grigorescu

##! A detection script for UDP DoS Flows

@load base/protocols/conn

module UDPDoS;

export {

    redef enum Notice::Type += {
        Detected,

grigorescu

@load base/frameworks/sumstats
@load base/protocols/smtp
module SMTP;

export {
    redef enum Notice::Type += {
        ## Generated if a user is sending mail to too many recipients
        ExcessiveRecipients
    };

grigorescu

module Exposed;

export {
    redef enum Notice::Type += {
        Service
    };
    const exposed_services: table[port] of string ={} &redef;
}

redef exposed_services+= [[11211/tcp] = "memcached"];

grigorescu

for i in $(git grep -l event); do cat $i | perl -e '$input=join("", <>); for ($input=~/^\s*(event [^(]+\([^)]*?\))/mg) { s/\n\s*/ /g; s/%//g; print "$_ { }\n"; }' ; done