Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Updates for the SOCKS analyzer.

Browse source 
- Now supports SOCKSv5 in the analyzer and the DPD sigs.

- Reworked the core events.

- Tests.

- A SOCKS log!
This commit is contained in:
Seth Hall 2012-06-20 13:58:25 -04:00
parent c30c0d5ff2
commit 896f252a31
16 changed files with 411 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/base/frameworks/dpd/dpd.sig
View file

@ -162,33 +162,48 @@ signature dpd_teredo {
enable "teredo"
}
signature dpd_socks_client {
signature dpd_socks4_client {
ip-proto == tcp
# '32' is a rather arbitrary max length for the user name.
payload /^\x04[\x01\x02].{0,32}\x00/
tcp-state originator
}
signature dpd_socks_server {
signature dpd_socks4_server {
ip-proto == tcp
requires-reverse-signature dpd_socks_client
requires-reverse-signature dpd_socks4_client
payload /^\x00[\x5a\x5b\x5c\x5d]/
tcp-state responder
enable "socks"
}
signature dpd_socks_reverse_client {
signature dpd_socks4_reverse_client {
ip-proto == tcp
# '32' is a rather arbitrary max length for the user name.
payload /^\x04[\x01\x02].{0,32}\x00/
tcp-state responder
}
signature dpd_socks_reverse_server {
signature dpd_socks4_reverse_server {
ip-proto == tcp
requires-reverse-signature dpd_socks_client
requires-reverse-signature dpd_socks4_reverse_client
payload /^\x00[\x5a\x5b\x5c\x5d]/
tcp-state originator
enable "socks"
}
signature dpd_socks5_client {
ip-proto == tcp
payload /^\x05/
tcp-state originator
}
signature dpd_socks5_server {
ip-proto == tcp
requires-reverse-signature dpd_socks5_client
payload /^\x05/
tcp-state responder
enable "socks"
}