mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
849875e8be
This analyzer parses the Remote Frame Buffer protocol, usually referred to as the 'VNC protocol'. It supports several dialects (3.3, 3.7, 3.8) and also handles the Apple Remote Desktop variant. It will log such facts as client/server versions, authentication method used, authentication result, height, width and name of the shared screen. It also includes two testcases. Todo: Apple Remote Desktop seems to have some bytes prepended to the screen name. This is not interepreted correctly.
75 lines
2.1 KiB
Text
75 lines
2.1 KiB
Text
##! This script loads everything in the base/ script directory. If you want
|
|
##! to run Bro without all of these scripts loaded by default, you can use
|
|
##! the ``-b`` (``--bare-mode``) command line argument. You can also copy the
|
|
##! "@load" lines from this script to your own script to load only the scripts
|
|
##! that you actually want.
|
|
|
|
@load base/utils/site
|
|
@load base/utils/active-http
|
|
@load base/utils/addrs
|
|
@load base/utils/conn-ids
|
|
@load base/utils/dir
|
|
@load base/utils/directions-and-hosts
|
|
@load base/utils/exec
|
|
@load base/utils/files
|
|
@load base/utils/numbers
|
|
@load base/utils/paths
|
|
@load base/utils/patterns
|
|
@load base/utils/queue
|
|
@load base/utils/strings
|
|
@load base/utils/thresholds
|
|
@load base/utils/time
|
|
@load base/utils/urls
|
|
|
|
# This has some deep interplay between types and BiFs so it's
|
|
# loaded in base/init-bare.bro
|
|
#@load base/frameworks/logging
|
|
@load base/frameworks/notice
|
|
@load base/frameworks/analyzer
|
|
@load base/frameworks/dpd
|
|
@load base/frameworks/signatures
|
|
@load base/frameworks/packet-filter
|
|
@load base/frameworks/software
|
|
@load base/frameworks/communication
|
|
@load base/frameworks/control
|
|
@load base/frameworks/cluster
|
|
@load base/frameworks/intel
|
|
@load base/frameworks/reporter
|
|
@load base/frameworks/sumstats
|
|
@load base/frameworks/tunnels
|
|
@ifdef ( BrokerComm::enable )
|
|
@load base/frameworks/openflow
|
|
@load base/frameworks/netcontrol
|
|
@endif
|
|
|
|
@load base/protocols/conn
|
|
@load base/protocols/dhcp
|
|
@load base/protocols/dnp3
|
|
@load base/protocols/dns
|
|
@load base/protocols/ftp
|
|
@load base/protocols/http
|
|
@load base/protocols/irc
|
|
@load base/protocols/krb
|
|
@load base/protocols/modbus
|
|
@load base/protocols/mysql
|
|
@load base/protocols/pop3
|
|
@load base/protocols/radius
|
|
@load base/protocols/rdp
|
|
@load base/protocols/rfb
|
|
@load base/protocols/sip
|
|
@load base/protocols/snmp
|
|
@load base/protocols/smtp
|
|
@load base/protocols/socks
|
|
@load base/protocols/ssh
|
|
@load base/protocols/ssl
|
|
@load base/protocols/syslog
|
|
@load base/protocols/tunnels
|
|
|
|
@load base/files/pe
|
|
@load base/files/hash
|
|
@load base/files/extract
|
|
@load base/files/unified2
|
|
@load base/files/x509
|
|
|
|
@load base/misc/find-checksum-offloading
|
|
@load base/misc/find-filtered-trace
|