mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 03:58:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/bernhard/software
Conflicts: scripts/base/frameworks/software/main.bro scripts/policy/protocols/ftp/software.bro
This commit is contained in:
Bernhard Amann
commit
eacdffff90
262 changed files with 16869 additions and 5714 deletions
|
|
@ -1,15 +1,18 @@
|
|||
##! This script takes MD5 sums of files transferred over HTTP and checks them with
|
||||
##! Team Cymru's Malware Hash Registry (http://www.team-cymru.org/Services/MHR/).
|
||||
##! Detect file downloads over HTTP that have MD5 sums matching files in Team
|
||||
##! Cymru's Malware Hash Registry (http://www.team-cymru.org/Services/MHR/).
|
||||
##! By default, not all file transfers will have MD5 sums calculated. Read the
|
||||
##! documentation for the :doc:base/protocols/http/file-hash.bro script to see how to
|
||||
##! configure which transfers will have hashes calculated.
|
||||
##! documentation for the :doc:base/protocols/http/file-hash.bro script to see
|
||||
##! how to configure which transfers will have hashes calculated.
|
||||
|
||||
@load base/frameworks/notice
|
||||
@load base/protocols/http
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## If the MD5 sum of a file transferred over HTTP
|
||||
## The MD5 sum of a file transferred over HTTP matched in the
|
||||
## malware hash registry.
|
||||
Malware_Hash_Registry_Match
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
##! Intelligence based HTTP detections.
|
||||
##! Intelligence based HTTP detections. Not yet working!
|
||||
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
|
|
|||
|
|
@ -12,12 +12,14 @@ export {
|
|||
SQL_Injection_Attacker,
|
||||
## Indicates that a host was seen to have SQL injection attacks against
|
||||
## it. This is tracked by IP address as opposed to hostname.
|
||||
SQL_Injection_Attack_Against,
|
||||
SQL_Injection_Victim,
|
||||
};
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
SQL_ATTACKER,
|
||||
SQL_ATTACKS_AGAINST,
|
||||
## Metric to track SQL injection attackers.
|
||||
SQLI_ATTACKER,
|
||||
## Metrics to track SQL injection victims.
|
||||
SQLI_VICTIM,
|
||||
};
|
||||
|
||||
redef enum Tags += {
|
||||
|
|
@ -30,17 +32,17 @@ export {
|
|||
COOKIE_SQLI,
|
||||
};
|
||||
|
||||
## This defines the threshold that determines if an SQL injection attack
|
||||
## Defines the threshold that determines if an SQL injection attack
|
||||
## is ongoing based on the number of requests that appear to be SQL
|
||||
## injection attacks.
|
||||
const sqli_requests_threshold = 50 &redef;
|
||||
|
||||
## Interval at which to watch for the :bro:id:`sqli_requests_threshold`
|
||||
## variable to be crossed. At the end of each interval the counter is
|
||||
## reset.
|
||||
## Interval at which to watch for the
|
||||
## :bro:id:`HTTP::sqli_requests_threshold` variable to be crossed.
|
||||
## At the end of each interval the counter is reset.
|
||||
const sqli_requests_interval = 5min &redef;
|
||||
|
||||
## This regular expression is used to match URI based SQL injections
|
||||
## Regular expression is used to match URI based SQL injections.
|
||||
const match_sql_injection_uri =
|
||||
/[\?&][^[:blank:]\x00-\x37\|]+?=[\-[:alnum:]%]+([[:blank:]\x00-\x37]|\/\*.*?\*\/)*['"]?([[:blank:]\x00-\x37]|\/\*.*?\*\/|\)?;)+.*?([hH][aA][vV][iI][nN][gG]|[uU][nN][iI][oO][nN]|[eE][xX][eE][cC]|[sS][eE][lL][eE][cC][tT]|[dD][eE][lL][eE][tT][eE]|[dD][rR][oO][pP]|[dD][eE][cC][lL][aA][rR][eE]|[cC][rR][eE][aA][tT][eE]|[iI][nN][sS][eE][rR][tT])([[:blank:]\x00-\x37]|\/\*.*?\*\/)+/
|
||||
| /[\?&][^[:blank:]\x00-\x37\|]+?=[\-0-9%]+([[:blank:]\x00-\x37]|\/\*.*?\*\/)*['"]?([[:blank:]\x00-\x37]|\/\*.*?\*\/|\)?;)+([xX]?[oO][rR]|[nN]?[aA][nN][dD])([[:blank:]\x00-\x37]|\/\*.*?\*\/)+['"]?(([^a-zA-Z&]+)?=|[eE][xX][iI][sS][tT][sS])/
|
||||
|
|
@ -56,14 +58,14 @@ event bro_init() &priority=3
|
|||
# determine when it looks like an actual attack and how to respond when
|
||||
# thresholds are crossed.
|
||||
|
||||
Metrics::add_filter(SQL_ATTACKER, [$log=F,
|
||||
Metrics::add_filter(SQLI_ATTACKER, [$log=F,
|
||||
$notice_threshold=sqli_requests_threshold,
|
||||
$break_interval=sqli_requests_interval,
|
||||
$note=SQL_Injection_Attacker]);
|
||||
Metrics::add_filter(SQL_ATTACKS_AGAINST, [$log=F,
|
||||
$notice_threshold=sqli_requests_threshold,
|
||||
$break_interval=sqli_requests_interval,
|
||||
$note=SQL_Injection_Attack_Against]);
|
||||
Metrics::add_filter(SQLI_VICTIM, [$log=F,
|
||||
$notice_threshold=sqli_requests_threshold,
|
||||
$break_interval=sqli_requests_interval,
|
||||
$note=SQL_Injection_Victim]);
|
||||
}
|
||||
|
||||
event http_request(c: connection, method: string, original_URI: string,
|
||||
|
|
@ -73,7 +75,7 @@ event http_request(c: connection, method: string, original_URI: string,
|
|||
{
|
||||
add c$http$tags[URI_SQLI];
|
||||
|
||||
Metrics::add_data(SQL_ATTACKER, [$host=c$id$orig_h], 1);
|
||||
Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h], 1);
|
||||
Metrics::add_data(SQLI_ATTACKER, [$host=c$id$orig_h], 1);
|
||||
Metrics::add_data(SQLI_VICTIM, [$host=c$id$resp_h], 1);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
##! Detect and log web applications through the software framework.
|
||||
|
||||
@load base/frameworks/signatures
|
||||
@load base/frameworks/software
|
||||
@load base/protocols/http
|
||||
|
|
@ -10,10 +12,12 @@ redef Signatures::ignored_ids += /^webapp-/;
|
|||
|
||||
export {
|
||||
redef enum Software::Type += {
|
||||
## Identifier for web applications in the software framework.
|
||||
WEB_APPLICATION,
|
||||
};
|
||||
|
||||
redef record Software::Info += {
|
||||
## Most root URL where the software was discovered.
|
||||
url: string &optional &log;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
##! This script take advantage of a few ways that installed plugin information
|
||||
##! leaks from web browsers.
|
||||
##! Detect browser plugins as they leak through requests to Omniture
|
||||
##! advertising servers.
|
||||
|
||||
@load base/protocols/http
|
||||
@load base/frameworks/software
|
||||
|
|
@ -13,6 +13,7 @@ export {
|
|||
};
|
||||
|
||||
redef enum Software::Type += {
|
||||
## Identifier for browser plugins in the software framework.
|
||||
BROWSER_PLUGIN
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,8 +6,11 @@ module HTTP;
|
|||
|
||||
export {
|
||||
redef enum Software::Type += {
|
||||
## Identifier for web servers in the software framework.
|
||||
SERVER,
|
||||
## Identifier for app servers in the software framework.
|
||||
APPSERVER,
|
||||
## Identifier for web browsers in the software framework.
|
||||
BROWSER,
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
##! This script extracts and logs variables from cookies sent by clients
|
||||
##! Extracts and logs variables names from cookies sent by clients.
|
||||
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
|
@ -6,6 +6,7 @@
|
|||
module HTTP;
|
||||
|
||||
redef record Info += {
|
||||
## Variable names extracted from all cookies.
|
||||
cookie_vars: vector of string &optional &log;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,12 @@
|
|||
##! This script extracts and logs variables from the requested URI
|
||||
##! Extracts and log variables from the requested URI in the default HTTP
|
||||
##! logging stream.
|
||||
|
||||
@load base/protocols/http
|
||||
|
||||
module HTTP;
|
||||
|
||||
redef record Info += {
|
||||
## Variable names from the URI.
|
||||
uri_vars: vector of string &optional &log;
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue