Commit graph

16 commits

Author SHA1 Message Date
Seth Hall
51b926f16a Fixed problem with HTTP file hashing
- HTTP file hashing now won't generate MD5 sums if
  a content gap happened during the file transfer.
2011-06-16 10:48:55 -04:00
Seth Hall
a8f760c570 Loading the http/file-extract by default with the http/ scripts.
- Nothing is extracted by default.
2011-06-15 13:27:49 -04:00
Seth Hall
e792faab04 File identification and hashing now working and improved.
- File type identification falls back to libmagic
  if nothing is detected by the sigs.
- File extraction broken and waiting upon a fix for
  ticket #474
2011-06-15 13:11:11 -04:00
Seth Hall
ad66c9c4d9 Script cleanup.
- Defaults for all built-in asset tracking changed to LOCAL_HOSTS
- Added a tuning script for changing asset tracking
  to ALL_HOSTS in all of the core scripts that do
  asset tracking.
- Default Notice::policy files notices instead of alarming on them.
- Moved KnownHosts::Info back to export section because
  the log_known_hosts event can't be defined in the
  export section without it.
- Moved the Malware Hash Registry detection out of
  the core HTTP protocol scripts and added it to the
  all.bro script.
2011-06-15 11:27:39 -04:00
Seth Hall
c327144ac0 Extract application server software based on X-Powered-By header. 2011-06-13 21:56:18 -04:00
Seth Hall
08dca169f6 Fixed a problem with accessing the method attribute on an HTTP::Info record.
- Found by Jim Barlow.
2011-06-13 14:30:16 -04:00
Seth Hall
cbe3dc811e HTTP script updates
- Fixed bug with new sessions accidently being created
  just after logging which caused a lot of empty records
  to be logged.
- Readded the HTTP::MD5 notice for when an MD5 sum is
  calculated for HTTP response bodies.
- Fixed bug with extracting value from content-length
  headers.
- Flushing values from md5 sum generation more reliably
  to avoid leaking memory.
2011-06-10 09:25:42 -04:00
Seth Hall
d3d9fedd2c Reshuffling notice declarations to make them exported.
- Notices were not available outside of their namespaces.
2011-06-09 11:59:06 -04:00
Seth Hall
29bfc5eff1 Fixed some new bugs with file extraction. 2011-06-07 23:12:49 -04:00
Seth Hall
63efdc89ef Fixes to HTTP scripts based on comments from Jon. 2011-06-07 23:09:31 -04:00
Seth Hall
0c1dac2fce Cleaned up and normalized file extraction across protocols. 2011-06-07 23:08:37 -04:00
Seth Hall
8a0e14f0dc Fixed a bug with detecting webapps. 2011-06-07 17:03:32 -04:00
Seth Hall
0de6393c6f Removed an HTTP dependency that is now gone. 2011-06-07 16:38:41 -04:00
Seth Hall
6c9ff37e61 Removed the extended http script since it wasn't used. 2011-06-07 16:35:25 -04:00
Seth Hall
8bffd350a4 Updating to use the new directory loading technique. 2011-06-03 07:47:49 -04:00
Seth Hall
ae3bd76769 Reorganizing the policy scripts for clarity. 2011-06-01 10:07:53 -04:00