sethhall

redef record HTTP::Info += {
	potential_fname: string &optional;
};

event http_request(c: connection, method: string, original_URI: string,
                   unescaped_URI: string, version: string) &priority=5
	{
	# Get rid of uri arguments
	local path = split_string(c$http$uri, /\?/)[0];

sethhall

global watching_icmp: table[conn_id, count] of time &create_expire=3secs;

event icmp_echo_request(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
	{
	watching_icmp[c$id, seq] = network_time();
	}

event icmp_echo_reply(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
	{
	if ( [c$id, seq] !in watching_icmp )

sethhall

##! This script is to avoid CVE-2015-1788 which is explained in
##! detail at http://jpb.io.  It is a denial of service against
##! OpenSSL which will cause Bro processes to lock up.
##! WARNING - This script should only be used temporarily until
##!           your OpenSSL library is upgraded.  This script can
##!           then be removed.


@if(  /2\.3/ in bro_version() )
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-100

sethhall

diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index d0b1ea2..c1e5e3d 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -505,10 +505,12 @@ void File::EndOfFile()
       if ( ! bof_buffer.full )
               {
               DBG_LOG(DBG_FILE_ANALYSIS, "[%s] File over but bof_buffer not full.", id.c_str());
-               bof_buffer.full = true;
+               bof_buffer.full                                                          = true;

sethhall

# Detect bad guys

sethhall

module GIF;

import BinPAC;


type Header = unit {
	%byteorder = BinPAC::ByteOrder::Little;

	signature : bytes &length=3; #This needs to either be a literal b"GIF" or have a &check attribute when that exists
	version   : bytes &length=3;

sethhall

const DIR="" &redef;

@load base/utils/dir
@load frameworks/files/hash-all-files

redef exit_only_after_terminate=T;

event bro_init()
	{

sethhall

# Jason Batchelor Edits, 9/19/2014
# Signatures informed by the following resource
# http://www.garykessler.net/library/file_sigs.html
signature file-olecf {
file-magic /(\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1)/
file-mime "application/olecf", 150
}
signature file-ooxml {
file-magic /(\x50\x4b\x03\x04\x14\x00\x06\x00)/
file-mime "application/vnd.openxmlformats-officedocument", 100

sethhall

Keybase proof

I hereby claim:

• I am sethhall on github.
• I am remor (https://keybase.io/remor) on keybase.
• I have a public key whose fingerprint is 421B 904C FF8C 56F0 D94C 88EB C4B7 768B D10C DBD5

To claim this, I am signing this object:

sethhall

redef exit_only_after_terminate = T;

module BroExchangeWatch;

export {
	redef enum Notice::Type += {
		Woo,
	};
}