Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
19623 commits 387 branches 195 tags 255 MiB
Commit graph

18 commits

Author SHA1 Message Date
Arne Welzel
b2a2ad7e10 smb2/read: Parse only 1 byte for data_offset, ignore reserved1 
A user provided a SMB2 pcap with the reserved1 field of a ReadResponse
set to 1 instead of 0. This confused the padding computation due to
including this byte into the offset. Properly split data_offset and
reserved1 into individual byte fields.

Closes #4730
 2025-08-08 16:12:20 +02:00
Arne Welzel
ff58be2f36 ldap: Only switch into MS_KRB5 mode if responseToken exists 
If the server doesn't include a responseToken within negTokenResp,
assume there won't be signing or sealing happening on the
connection. Don't switch into MS_KRB5 mode.

Closes #4275
 2025-04-15 20:10:52 +02:00
Tim Wojtulewicz
195b87b873 Make SNAP analyzer use both OUI and protocol for forwarding 2025-03-24 15:20:50 -07:00
Arne Welzel
776c003033 PacketAnalyzer::Geneve: Add get_options() 
Allow to extract Geneve options on-demand, for example during a
new_connection() event.
 2025-02-22 12:19:42 -08:00
Tim Wojtulewicz
f0d7984bac Merge remote-tracking branch 'origin/topic/timw/add-note-about-pe-pcap' 
* origin/topic/timw/add-note-about-pe-pcap:
  Add note to Traces/README about possible malware in pe/pe.trace
  Fix formatting of Traces/README entry for modbus-eit.trace
 2025-02-03 18:34:15 -07:00
Arne Welzel
6a14e64a17 QUIC: Parse all QUIC packets in a UDP datagram 
A UDP datagram may contain multiple QUIC packets, but the parser so far
handled only the very first packet, ignoring any subsequent packets.

Fixes #4198
 2025-02-03 17:36:37 +01:00
Tim Wojtulewicz
a5b0a9467d Add note to Traces/README about possible malware in pe/pe.trace 2025-01-30 13:28:35 -07:00
Tim Wojtulewicz
430e3ab940 Fix formatting of Traces/README entry for modbus-eit.trace 2025-01-30 13:28:17 -07:00
Arne Welzel
079ae460a7 btest/http: Demo StreamEvent analyzer with HTTP::upgrade_analyzers 
Relates to #4068
 2024-12-06 16:12:40 +01:00
Arne Welzel
5200b84fb3 Merge branch 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek 
* 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek:
  account for spaces encoding to plus signs in sqli regex detection
 2024-10-29 14:08:39 +01:00
Arne Welzel
b4fdce8d5b btest/pop3: Add somewhat more elaborate testing 
PCAP taken from here: https://tranalyzer.com/tutorial/pop and reference
added to Traces/README.
 2024-09-18 17:31:13 +02:00
Arne Welzel
26c4d0df8b btest/ldap: Add regression test for #3919 
This works as expected in master, it's just that we forgot to backport
PR #3845 to 7.0.1. Add the PCAP from Martin anyhow.

Closes #3919.
 2024-09-06 19:16:49 +02:00
Tim Wojtulewicz
269ca3189c Add weird for unhandled opcodes in DNS analyzer 2024-09-04 13:01:24 -07:00
Arne Welzel
02e3d30227 ldap: Recognize SASL+SPNEGO+NTLMSSP 
The ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap file was harvested
from the CTU-SME-11 (Experiment-VM-Microsoft-Windows7AD-1) dataset
at https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).

Closes #3853
 2024-07-26 14:37:36 +02:00
Benjamin Bannier
d7db52dff6 Integrate spicy-ldap test suite 2023-10-10 09:21:57 +02:00
Tim Wojtulewicz
406a406813 Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-07 13:44:37 -07:00
Josh Soref
74af1ebe16 Spelling testing 
* alphabet
* another
* associated
* avoiding
* base
* because
* constructors
* defining
* deterministic
* directly
* endlessly
* entity
* function
* indefinitely
* initial
* interpreter
* into
* modifying
* negotiate
* nonexistent
* observations
* occasional
* omission
* orphaned
* overridden
* passing
* primitive
* produces
* reassembly
* repository
* restore
* shouldn't
* something
* statement
* the
* therefore
* transferred
* uninitialized
* unsuccessful

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
 2022-11-16 20:05:03 -05:00
Johanna Amann
f76a95a2c2 Merge remote-tracking branch 'origin/topic/christian/install-btest-tooling' 
* origin/topic/christian/install-btest-tooling:
  Explain zeek-config options in help output
  Sort variables at top of zeek-config alphabetically
  Install Zeek's btest tooling with the distribution
 2021-05-10 10:26:59 +01:00