Commit graph

15 commits

Author SHA1 Message Date
Seth Hall
205a28bad8 Updated Windows version detection to include Windows 10
Thanks to Fatema Bannatwala for finding it and Keith Lehigh
and Mike Patterson for verifying.
2017-02-21 15:06:39 -05:00
Aaron Eppert
5d1ed9c134 Update windows-version-detection.bro
mscrl.microsoft.com is the proper hostname, however to be safe, let's use regex to identify it.
2015-12-04 09:46:14 -05:00
Jon Siwek
23f04835c6 Deprecate split* family of BIFs.
These functions are now deprecated in favor of alternative versions that
return a vector of strings rather than a table of strings.

Deprecated functions:

- split: use split_string instead.
- split1: use split_string1 instead.
- split_all: use split_string_all instead.
- split_n: use split_string_n instead.
- cat_string_array: see join_string_vec instead.
- cat_string_array_n: see join_string_vec instead.
- join_string_array: see join_string_vec instead.
- sort_string_array: use sort instead instead.
- find_ip_addresses: use extract_ip_addresses instead.

Changed functions:

- has_valid_octets: uses a string_vec parameter instead of string_array.

Addresses BIT-924, BIT-757.
2015-01-21 15:34:42 -06:00
Michal Purzynski
ebb2240e97 Update windows-version-detection.bro 2014-11-27 19:41:20 +01:00
Seth Hall
7a52b8eb56 Merge remote-tracking branch 'origin/topic/vladg/cryptoapi'
* origin/topic/vladg/cryptoapi:
  Add Windows detection based on CryptoAPI HTTP traffic as a software framework policy script.
2014-11-05 09:47:17 -05:00
Vlad Grigorescu
d600d41a55 Add Windows detection based on CryptoAPI HTTP traffic as a software framework policy script. 2014-11-03 13:52:58 -05:00
Daniel Thayer
24da7ab839 Fix typos and formatting in the policy/frameworks docs
Also updated some tests related to these changes.
2013-10-21 01:23:08 -05:00
Seth Hall
4bddcd2379 Fixed a bug in the vulnerable software script and added a test. 2013-04-25 14:56:14 -04:00
Robin Sommer
788c0d547d Merge remote-tracking branch 'origin/topic/seth/software-version-updates2'
* origin/topic/seth/software-version-updates2:
  Correctly handle DNS lookups for software version ranges.
  Improvements to vulnerable software detection.
  Update software version parsing and comparison to account for a third numeric subversion.

Closes #938.
2013-03-17 12:38:25 -07:00
Seth Hall
e974950c6d Correctly handle DNS lookups for software version ranges. 2013-02-06 13:59:17 -05:00
Seth Hall
ff3ec04f32 Improvements to vulnerable software detection.
- Add a DNS based updating method.  This needs to be tested still.

 - Vulnerable version ranges are used now instead
   of only single versions.  This can deal with
   software with multiple stable major versions.
2013-02-06 13:59:12 -05:00
Seth Hall
f603d0121b This completes framework documentation package 4.
- Closes ticket #709
2012-01-06 16:36:22 -05:00
Seth Hall
fc5f22cb5d Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup' 2011-08-25 16:44:31 -04:00
Jon Siwek
47500ceef4 Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process.  The test is still
failing in a "known" way due to hot.conn.bro and scan.bro.

Adressess #545
2011-08-10 15:38:21 -05:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00