Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

spicy-redis: Add dpd signature and clean pcaps

Browse source
This commit is contained in:
Evan Typanski 2024-11-26 11:13:12 -05:00
parent f0e9f46c7c
commit 7f28ec8bc5
66 changed files with 572 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/redis/__load__.zeek
View file

@ -1 +1,3 @@
@load ./main
@load-sigs ./dpd.sig

16
scripts/base/protocols/redis/dpd.sig Normal file
View file

@ -0,0 +1,16 @@
signature resp-client {
ip-proto == tcp
payload /^.*\r\n/
tcp-state originator
requires-reverse-signature resp-serialized-server
event "Found possible Redis client data"
enable "spicy_Redis"
}
signature resp-serialized-server {
ip-proto == tcp
payload /^([-+_,].*\r\n|[:$*#(!=%`~>][+-]?[0-9]+(\.[0-9]*)?\r\n)/
tcp-state responder
event "Found Redis server data"
enable "spicy_Redis"
}

1
scripts/base/protocols/redis/main.zeek
View file

@ -1,4 +1,5 @@
@load base/protocols/conn/removal-hooks
@load base/frameworks/signatures
module Redis;