mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
39444b5af7
- This caused us to lose signatures for POP3 and Bittorrent. These will need discovered in the repository again when we add scripts for those analyzers.
48 lines
1.2 KiB
Standard ML
48 lines
1.2 KiB
Standard ML
signature dpd_socks4_client {
|
|
ip-proto == tcp
|
|
# '32' is a rather arbitrary max length for the user name.
|
|
payload /^\x04[\x01\x02].{0,32}\x00/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_socks4_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks4_client
|
|
payload /^\x00[\x5a\x5b\x5c\x5d]/
|
|
tcp-state responder
|
|
enable "socks"
|
|
}
|
|
|
|
signature dpd_socks4_reverse_client {
|
|
ip-proto == tcp
|
|
# '32' is a rather arbitrary max length for the user name.
|
|
payload /^\x04[\x01\x02].{0,32}\x00/
|
|
tcp-state responder
|
|
}
|
|
|
|
signature dpd_socks4_reverse_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks4_reverse_client
|
|
payload /^\x00[\x5a\x5b\x5c\x5d]/
|
|
tcp-state originator
|
|
enable "socks"
|
|
}
|
|
|
|
signature dpd_socks5_client {
|
|
ip-proto == tcp
|
|
# Watch for a few authentication methods to reduce false positives.
|
|
payload /^\x05.[\x00\x01\x02]/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_socks5_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks5_client
|
|
# Watch for a single authentication method to be chosen by the server or
|
|
# the server to indicate the no authentication is required.
|
|
payload /^\x05(\x00|\x01[\x00\x01\x02])/
|
|
tcp-state responder
|
|
enable "socks"
|
|
}
|
|
|
|
|