Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add bad ARP tests

Browse source 
The capture file (btest/Traces/arp-leak.pcap) contains the
exploitation of an ARP leak flaw against NetBSD 7.0.2 using Scapy
etherleak() function.
This commit is contained in:
Pierre LALET 2018-05-18 17:39:48 +02:00
parent 7ffc162383
commit 8315aa36a6
3 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/Baseline/scripts.base.protocols.arp.bad/.stdout Normal file
View file

@ -0,0 +1,6 @@
BAD, 192.168.123.1, 7e:8e:20:d8:23:a7, 192.168.123.2, 00:00:00:00:00:00, corrupt-arp-header (hrd=1, hln=255)
BAD, 192.168.123.2, 52:54:00:12:34:57, 192.168.123.1, 7e:8e:20:d8:23:a7, corrupt-arp-header (hrd=1, hln=255)
BAD, 192.168.123.1, 7e:8e:20:d8:23:a7, 192.168.123.2, 00:00:00:00:00:00, corrupt-arp-header (pro=2048, pln=255)
BAD, 192.168.123.2, 52:54:00:12:34:57, 192.168.123.1, 7e:8e:20:d8:23:a7, corrupt-arp-header (pro=2048, pln=255)
BAD, 192.168.123.1, 7e:8e:20:d8:23:a7, 192.168.123.2, 00:00:00:00:00:00, corrupt-arp-header (hrd=1, hln=255)
BAD, 192.168.123.2, 52:54:00:12:34:57, 192.168.123.1, 7e:8e:20:d8:23:a7, corrupt-arp-header (hrd=1, hln=255)

BIN
testing/btest/Traces/arp-leak.pcap Normal file
View file

Binary file not shown.

17
testing/btest/scripts/base/protocols/arp/bad.test Normal file
View file

@ -0,0 +1,17 @@
# @TEST-EXEC: bro -r $TRACES/arp-leak.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
event arp_request(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)
{
print "REQ", mac_src, mac_dst, SPA, SHA, TPA, THA;
}
event arp_reply(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)
{
print "REP", mac_src, mac_dst, SPA, SHA, TPA, THA;
}
event bad_arp(SPA: addr, SHA: string, TPA: addr, THA: string, explanation: string)
{
print "BAD", SPA, SHA, TPA, THA, explanation;
}