Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...

Browse source
This commit is contained in:
Bernhard Amann 2011-12-08 15:27:47 -08:00
parent 311cd1b116
commit dcc7fe3c38
7 changed files with 124 additions and 119 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/policy/protocols/http/software-browser-plugins.bro
View file

@ -26,8 +26,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
# Flash doesn't include it's name so we'll add it here since it
# simplifies the version parsing.
value = cat("Flash/", value);
local flash_version = Software::parse(value, c$id$orig_h, BROWSER_PLUGIN);
Software::found(c$id, flash_version);
Software::found([$id=c$id, $banner=flash_version, $host=c$id$orig_h, $sw_type=BROWSER_PLUGIN]);
}
}
else
@ -54,7 +53,7 @@ event log_http(rec: Info)
local plugins = split(sw, /[[:blank:]]*;[[:blank:]]*/);
for ( i in plugins )
Software::found(rec$id, Software::parse(plugins[i], rec$id$orig_h, BROWSER_PLUGIN));
Software::found([$id=rec$id, $banner=plugins[i], $host=rec$id$orig_h, $sw_type=BROWSER_PLUGIN]);
}
}
}
}

8
scripts/policy/protocols/http/software.bro
View file

@ -20,18 +20,18 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
if ( is_orig )
{
if ( name == "USER-AGENT" && ignored_user_agents !in value )
Software::found(c$id, Software::parse(value, c$id$orig_h, BROWSER));
Software::found([$id=c$id, $banner=value, $host=c$id$orig_h, $sw_type=BROWSER]);
}
else
{
if ( name == "SERVER" )
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, SERVER));
Software::found([$id=c$id, $banner=value, $host=c$id$resp_h, $host_p=c$id$resp_p, $sw_type=SERVER]);
else if ( name == "X-POWERED-BY" )
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, APPSERVER));
Software::found([$id=c$id, $banner=value, $host=c$id$resp_h, $host_p=c$id$resp_p, $sw_type=APPSERVER]);
else if ( name == "MICROSOFTSHAREPOINTTEAMSERVICES" )
{
value = cat("SharePoint/", value);
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, APPSERVER));
Software::found([$id=c$id, $banner=value, $host=c$id$resp_h, $host_p=c$id$resp_p, $sw_type=APPSERVER]);
}
}
}