Skip to content

Instantly share code, notes, and snippets.

View sethhall's full-sized avatar

Seth Hall sethhall

247 followers · 19 following
  • Columbus, OH
  • 04:57 (UTC -04:00)
View GitHub Profile
@sethhall
sethhall / gist:5467784
Created April 26, 2013 14:36
cwho
cwho () { ADDR=$1; host $ADDR; geoiplookup $ADDR | tail -n1; whois -h whois.cymru.com -- "-p -c -n -r -u -e -w ${ADDR}" | grep -v "^AS"; }
@sethhall
sethhall / gist:5483039
Created April 29, 2013 17:04
tiny ssh patch
diff --git a/scripts/base/protocols/ssh/main.bro b/scripts/base/protocols/ssh/main.bro
index cd20f4e..a8b784f 100644
--- a/scripts/base/protocols/ssh/main.bro
+++ b/scripts/base/protocols/ssh/main.bro
@@ -108,6 +108,8 @@ function check_ssh_connection(c: connection, done: bool)
if ( c$ssh$done )
return;
+ lookup_connection(c$id);
+
@sethhall
sethhall / cpu_pin.sh
Created May 13, 2013 15:54
CPU Pinning on FreeBSD
#!/usr/bin/env bash
# the number of workers we expect
WORKER_COUNT=7
# the number of proxies we expect
PROXY_COUNT=0
# the cpu mask for our default set
DFLT_SET="0,1,9,10,11"
# get short hostname
HOSTNAME=$(hostname -s)
@sethhall
sethhall / gist:5591615
Created May 16, 2013 13:14
cert from exe.
paste the following into: http://certlogik.com/decoder/
MIIXqwYJKoZIhvcNAQcCoIIXnDCCF5gCAQExCzAJBgUrDgMCGgUAMEwGCisGAQQBgjcCAQSgPjA8MBcGCisGAQQBgjcCAQ8wCQMBAKAEogKAADAhMAkGBSsOAwIaBQAEFKbTZvvCj5cDkxgWVtg79OiqTsRvoIISujCCA+4wggNXoAMCAQICEH6T6/t8xk5Z6kuad9QG/DswDQYJKoZIhvcNAQEFBQAwgYsxCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxFDASBgNVBAcTC0R1cmJhbnZpbGxlMQ8wDQYDVQQKEwZUaGF3dGUxHTAbBgNVBAsTFFRoYXd0ZSBDZXJ0aWZpY2F0aW9uMR8wHQYDVQQDExZUaGF3dGUgVGltZXN0YW1waW5nIENBMB4XDTEyMTIyMTAwMDAwMFoXDTIwMTIzMDIzNTk1OVowXjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMTAwLgYDVQQDEydTeW1hbnRlYyBUaW1lIFN0YW1waW5nIFNlcnZpY2VzIENBIC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxrLNJVEuXHBIK2CV5kSJXKm/cuCbEQ3Nrwr8uUFr7FMJ2jkMBJUO0oeJF9Oi3e8N0zCLXtJQAAvdN7b+0t0Qka81fRTvRRM5DEnMXgotptCvLmR6schsmTXEfsTHd+1FhAlOmqvVJLAV4RaUvic7nmef+jOJXPz3GktxK+Hsz5HkK+/B1iEGc/8UDUZmq12yfk2mHZSmDhcJgFMTIyTsU2sCB8B8NdN6SIqvK9/t0fCfm90obf6fDni2uiuqm5qonFn1h95hxEbziUKFL5V365Q6nLJ+qZSDT2JboyHylTkhE/xniRAeSC9dohIBdanhkRc1gRn5UwRN8xXnxycF
@sethhall
sethhall / gist:5952451
Last active December 19, 2015 12:09
grabbing content-disposition headers only in certain cases.
@load base/protocols/http
const watchlist_url_patterns = /^.*/test.php\// &redef;
redef record Conn::Info += {
content_disposition: string &optional &log;
};
event http_all_headers(c: connection, is_orig: bool, hlist: mime_header_list)
{
@sethhall
sethhall / rules-for-base.rst
Created July 22, 2013 18:17
Rules for base/

Rules for base

  • No printing! Use the reporter instead.
  • Frameworks shouldn't cause any performance overhead merely by the act of loading them.
  • If you really have to handle events outside of those generated by the module you're working on (like connection_established or connection_state_remove) triple check your code.
@sethhall
sethhall / http-title-ripper.bro
Created July 24, 2013 04:57
Rip titles out of web pages and add it to a title field in http.log
@load base/protocols/http
module HTTPTitleRipper;
export {
## The depth to search for titles in HTTP response bodies.
const search_depth = 10000;
redef record HTTP::Info += {
## A title from the webpage.
@sethhall
sethhall / http-header-logs.bro
Created August 5, 2013 04:00
Log HTTP headers and values
##! Extract and include the header names used for each request in the HTTP
##! logging stream. The headers in the logging stream will be stored in the
##! same order which they were seen on the wire.
@load base/protocols/http/main
module HTTP;
export {
redef record Info += {
@sethhall
sethhall / bro-exchange-update-watcher.bro
Created August 7, 2013 19:17
Everyone keeps asking about when the videos will be posted, so here's a script that runs in the preview release (git master).
redef exit_only_after_terminate = T;
module BroExchangeWatch;
export {
redef enum Notice::Type += {
Woo,
};
}
@sethhall
sethhall / gist:6283197
Created August 20, 2013 15:43
Remove an internal error call
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICM
index 732727d..43e961e 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -100,8 +100,7 @@ void ICMP_Analyzer::DeliverPacket(int len, const u_char* dat
else if ( ip->NextProto() == IPPROTO_ICMPV6 )
NextICMP6(current_timestamp, icmpp, len, caplen, data, ip);
else
- reporter->InternalError("unexpected next protocol in ICMP::Deliv
-