Created
April 10, 2014 17:35
-
-
Save sethhall/10405046 to your computer and use it in GitHub Desktop.
Bro heartbleed detector (http://blog.bro.org/2014/04/detecting-heartbleed-bug-using-bro.html) output for trace from http://blog.didierstevens.com/2014/04/09/heartbleed-packet-capture/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #separator \x09 | |
| #set_separator , | |
| #empty_field (empty) | |
| #unset_field - | |
| #path conn | |
| #open 2014-04-10-13-34-01 | |
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents | |
| #types time string addr port addr port enum string interval count count string bool count string count count count count set[string] | |
| 1397073996.257496 CHkC542U0S9hPPSQ0g 192.168.11.1 54848 192.168.11.128 443 tcp ssl 0.022342 233 17871 SF - 0 ShADadFf 13 765 17 18563 (empty) | |
| #close 2014-04-10-13-34-01 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #separator \x09 | |
| #set_separator , | |
| #empty_field (empty) | |
| #unset_field - | |
| #path files | |
| #open 2014-04-10-13-34-01 | |
| #fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted | |
| #types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string | |
| 1397073996.265120 FDDjjX2Ao9MbRQV4g 192.168.11.128 192.168.11.1 CHkC542U0S9hPPSQ0g SSL 0 SHA1,X509,MD5 - - 0.000000 - F 865 - 0 0 F - 3919581c4096629c304693bc108bcf8d 3fac71caf63fb57e302e24ebdde054fe49bb8513 - - | |
| #close 2014-04-10-13-34-01 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #separator \x09 | |
| #set_separator , | |
| #empty_field (empty) | |
| #unset_field - | |
| #path notice | |
| #open 2014-04-10-13-34-01 | |
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude | |
| #types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval bool string string string double double | |
| 1397073996.265414 CHkC542U0S9hPPSQ0g 192.168.11.1 54848 192.168.11.128 443 - - - tcp Heartbleed::SSL_Heartbeat_Attack An TLS heartbleed attack was detected! Record length 3, payload length 16384 - 192.168.11.1 192.168.11.128 443 - bro Notice::ACTION_LOG 3600.000000 F - - - - - | |
| 1397073996.266811 CHkC542U0S9hPPSQ0g 192.168.11.1 54848 192.168.11.128 443 - - - tcp Heartbleed::SSL_Heartbeat_Attack_Success An TLS heartbleed attack was detected and probably exploited - 192.168.11.1 192.168.11.128 443 - bro Notice::ACTION_LOG 3600.000000 F - - - - - | |
| #close 2014-04-10-13-34-01 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #separator \x09 | |
| #set_separator , | |
| #empty_field (empty) | |
| #unset_field - | |
| #path ssl | |
| #open 2014-04-10-13-34-01 | |
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id last_alert established cert_chain_fuids client_cert_chain_fuids subject issuer client_subject client_issuer | |
| #types time string addr port addr port string string string string string bool vector[string] vector[string] string string string string | |
| 1397073996.257718 CHkC542U0S9hPPSQ0g 192.168.11.1 54848 192.168.11.128 443 TLSv11 TLS_DHE_RSA_WITH_AES_256_CBC_SHA - - - F FDDjjX2Ao9MbRQV4g (empty) - - - - | |
| #close 2014-04-10-13-34-01 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #separator \x09 | |
| #set_separator , | |
| #empty_field (empty) | |
| #unset_field - | |
| #path x509 | |
| #open 2014-04-10-13-34-01 | |
| #fields ts id certificate.version certificate.serial certificate.subject certificate.issuer certificate.not_valid_before certificate.not_valid_after certificate.key_alg certificate.sig_alg certificate.key_type certificate.key_length certificate.exponent certificate.curve san.dns san.uri san.email san.ip basic_constraints.ca basic_constraints.path_len | |
| #types time string count string string string time time string string string count string string vector[string] vector[string] vector[string] vector[addr] bool count | |
| 1397073996.265120 FDDjjX2Ao9MbRQV4g 3 E776477CF9D359DB O=Internet Widgits Pty Ltd,ST=Some-State,C=AU O=Internet Widgits Pty Ltd,ST=Some-State,C=AU 1397086372.000000 1428622372.000000 rsaEncryption sha1WithRSAEncryption rsa 2048 65537 - - - - - T - | |
| #close 2014-04-10-13-34-01 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment