grigorescu

#!/usr/bin/python

import sys
import pygeoip
import dns.resolver
from IPy import IP
import pytz
import smtplib
import datetime

grigorescu

breakpoint_to_pcap

Overview

Given an input PCAP and a location in a Bro script, this script will filter the PCAP into a new file, which contains only the connections that visited that script location. This script can help filter a large PCAP to narrow down problematic connections, such as protocol violations, weirds, etc.

Example

grigorescu

#!/bin/bash
#
# Found on: http://hackforums.net/showthread.php?tid=914128
#
#Autorooter and backdoor bash-script
#Hopefully this script will come to good use
#Run n tell dat home, home, homeboy!!
#by: ludwig @ SSTeam.info
clear

grigorescu

##! Analysis of ARP Traffic.
##! This script logs ARP traffic while doing so builds an internal ARP cache
##! that can be used to determine when MAC/IP associations change.
##!
##! Written by Peter Erickson <[email protected]>
##! Reference: http://mailman.icsi.berkeley.edu/pipermail/bro/2011-November/004415.html
#
# Abbreviations are taken from RFC 826:
#
# SHA: source hardware address (i.e., MAC address)

grigorescu

local msg_types = {
   [0] = "None",
   [1] = "Version",
   [2] = "Serial",
   [3] = "Close",
   [4] = "Close all",
   [5] = "Error",
   [6] = "Connect to",
   [7] = "Connected",
   [8] = "Request events",

grigorescu

@load base/utils/site

event bro_init()
        {
        # First remove the default filter.
        Log::remove_default_filter(HTTP::LOG);
        
        # Add the filter to direct logs to the appropriate file name.
        Log::add_filter(HTTP::LOG, [$name = "http-directions",
                                    $path_func(id: Log::ID, path: string, rec: HTTP::Info) = {

grigorescu

##! Core script support for logging syslog messages.  This script represents 
##! one syslog message as one logged record.
##!
##! Note: This was slightly simplified for demo purposes

@load ./consts

module Syslog;

export {

grigorescu

Keybase proof

I hereby claim:

• I am grigorescu on github.
• I am vladg (https://keybase.io/vladg) on keybase.
• I have a public key whose fingerprint is BE8A E1D9 A108 4DBC 1BF0 28F6 C115 8FAB 632E 5272

To claim this, I am signing this object:

grigorescu

#!/usr/bin/env python2
##
## This script takes a line from the dpd.log generated with the
## policy/frameworks/dpd/packet-segment-logging.bro script, and
## outputs a PCAP to stdout
##
##    Vlad Grigorescu
##    [email protected]
##

grigorescu

##! Add support for X-Requested-With                                                                                                                                                                                                                                           
@load base/protocols/http
@load base/frameworks/software
@load policy/protocols/http/software-browser-plugins

module HTTP;

export {
        redef record HTTP::Info += {
                ## X-REQUESTED_WITH value, if set