Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/fox-ds/ssh-key-init-events' of github.com:fox-ds/zeek

Browse source 
* 'topic/fox-ds/ssh-key-init-events' of github.com:fox-ds/zeek:
  Added several events for detailed info on the SSH2 key init directions

* Straightened out the zeek:see lines in events.bif to be the same across all events.
This commit is contained in:
Arne Welzel 2022-12-06 10:01:45 +01:00
commit d9b7da334d
11 changed files with 252 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/scripts/base/protocols/ssh/ssh-reverse-connection.zeek Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: zeek -b -Cr $TRACES/ssh/reverse-ssh.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load base/protocols/ssh
event ssh2_ecc_init(c: connection, is_orig: bool) {
## If a machine sends out the initial key material for the handshake, this should come from the client.
## In most cases, this client is the machine that set up the TCP connection.
if ( ! is_orig ) {
print("Detected an ECC INIT not from the TCP client");
}
}

8
testing/btest/scripts/base/protocols/ssh/ssh_dh_gex_direction.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek -b -Cr $TRACES/ssh/sshguess.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load base/protocols/ssh
event ssh2_dh_gex_init(c: connection, is_orig: bool) {
print("Found SSH2_DH_GEX_INIT event");
}