Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Taking advantage of yet another trick to get installed browser plugins.

Browse source 
- With the software-browser-plugins script you can watch for Omniture
  advertising servers to grab the list of installed plugins.

- I reorganized the plugin detection a bit too to abstract it better.

- Removed the WEB_ prefix from all of the Software::Type HTTP enums.
  They were essentially redundant due to the full name already being
  HTTP::SERVER (for example).
This commit is contained in:
Seth Hall 2011-09-29 13:07:28 -04:00
parent 9e2ddac572
commit 0118621613
2 changed files with 66 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

59
scripts/policy/protocols/http/software-browser-plugins.bro Normal file
View file

@ -0,0 +1,59 @@
##! This script take advantage of a few ways that installed plugin information
##! leaks from web browsers
@load base/protocols/http
@load base/frameworks/software
module HTTP;
export {
redef record Info += {
## Indicates if the server is an omniture advertising server.
omniture: bool &default=F;
};
redef enum Software::Type += {
BROWSER_PLUGIN
};
}
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( is_orig )
{
if ( name == "X-FLASH-VERSION" )
{
# Flash doesn't include it's name so we'll add it here since it
# simplifies the version parsing.
value = cat("Flash/", value);
local flash_version = Software::parse(value, c$id$orig_h, BROWSER_PLUGIN);
Software::found(c$id, flash_version);
}
}
else
{
# Find if the server is Omniture
if ( name == "SERVER" && /^Omniture/ in value )
c$http$omniture = T;
}
}
event log_http(rec: Info)
{
# We only want to inspect requests that were sent to omniture advertising
# servers.
if ( rec$omniture && rec?$uri )
{
# We do {5,} because sometimes we see p=6 in the urls.
local parts = split_n(rec$uri, /&p=([^&]{5,});&/, T, 1);
if ( 2 in parts )
{
# We do sub_bytes here just to remove the extra extracted
# characters from the regex split above.
local sw = sub_bytes(parts[2], 4, |parts[2]|-5);
local plugins = split(sw, /[[:blank:]]*;[[:blank:]]*/);
for ( i in plugins )
Software::found(rec$id, Software::parse(plugins[i], rec$id$orig_h, BROWSER_PLUGIN));
}
}
}

34
scripts/policy/protocols/http/software.bro
View file

@ -6,19 +6,13 @@ module HTTP;
export {
redef enum Software::Type += {
WEB_SERVER,
WEB_APPSERVER,
WEB_BROWSER,
WEB_BROWSER_PLUGIN
SERVER,
APPSERVER,
BROWSER,
};
## The pattern of HTTP User-Agents which you would like to ignore.
const ignored_user_agents = /NO_DEFAULT/ &redef;
## These are patterns to identify browser plugins (including toolbars)
## based on the User-Agent header.
const plugin_user_agents = /BingBar [0-9\.]*/ ##< Bing toolbar
| /GoogleToolbar [0-9\.]*;/ &redef; ##< Google toolbar
}
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=2
@ -26,32 +20,18 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
if ( is_orig )
{
if ( name == "USER-AGENT" && ignored_user_agents !in value )
{
local ua_type = WEB_BROWSER;
if ( plugin_user_agents in value )
ua_type = WEB_BROWSER_PLUGIN;
Software::found(c$id, Software::parse(value, c$id$orig_h, ua_type));
}
else if ( name == "X-FLASH-VERSION" )
{
# Flash doesn't include it's name so we'll add it here since it
# simplifies the version parsing.
value = cat("Flash/", value);
local flash_version = Software::parse(value, c$id$orig_h, WEB_BROWSER_PLUGIN);
Software::found(c$id, flash_version);
}
Software::found(c$id, Software::parse(value, c$id$orig_h, BROWSER));
}
else
{
if ( name == "SERVER" )
Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_SERVER));
Software::found(c$id, Software::parse(value, c$id$resp_h, SERVER));
else if ( name == "X-POWERED-BY" )
Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
Software::found(c$id, Software::parse(value, c$id$resp_h, APPSERVER));
else if ( name == "MICROSOFTSHAREPOINTTEAMSERVICES" )
{
value = cat("SharePoint/", value);
Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
Software::found(c$id, Software::parse(value, c$id$resp_h, APPSERVER));
}
}
}