zeek/testing/btest/scripts/base/protocols/ftp/ftp-password-pass-command.zeek
Arne Welzel c36ae2f1a3 Merge branch 'pr/3946'
* pr/3946:
  Honor no plaintext password logging for PASS cmd

Closes #3946 - squashed commits into a single one.
2024-09-27 16:52:44 +02:00

12 lines
436 B
Text

# @TEST-DOC: Adding PASS to logged commands should log the password in password and arg column
# @TEST-EXEC: zeek -b -Cr $TRACES/ftp/ftp-password-pass-command.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "SYST", "QUIT" };
redef FTP::default_capture_password = T;