JustinAzoff

/*
   american fuzzy lop - postprocessor library example
   --------------------------------------------------

   Written and maintained by Michal Zalewski <lcamtuf@google.com>

   Copyright 2015 Google Inc. All rights reserved.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.

JustinAzoff

#!/usr/bin/env python

import difflib
import sys
import tarfile

def read(fn):
    with open(fn) as f:
        return f.readlines()

JustinAzoff

redef exit_only_after_terminate = T;

event test()
	{
    local src = 1.2.3.4;
    local dst = 8.8.8.8;
    local output = "";
	if ( T )
		{
		when ( local src_name = lookup_addr(src) )

JustinAzoff

module TerminateConnection;

export {
	redef enum Notice::Type += {
		TerminatingConnection,	# connection will be terminated
		TerminatingConnectionIgnored,	# connection terminated disabled
	};

	# Whether we're allowed (and/or are capable) to terminate connections
	# using "rst".

JustinAzoff

#
# A plugin to setup capture interfaces
# The plugin is off by default. To enable it, add "interfacesetup.enabled=1" to broctl.cfg.
#

import BroControl.plugin

class InterfaceSetupPlugin(BroControl.plugin.Plugin):
    def __init__(self):
        super(InterfaceSetupPlugin, self).__init__(apiversion=1)

JustinAzoff

#!/usr/bin/env python
import os
import sys

BRO_CERT_TEMPLATE = """#auto generated
redef SSL::root_certs += {
    ["%(subject)s"] = "%(cert)s"
};
"""

JustinAzoff

#!/usr/bin/env python
import os
import sys
import time

SIZE_TIMEOUT = 10

def get_size(f):
    for x in range(SIZE_TIMEOUT):
        try:

JustinAzoff

# /etc/sysconfig/modules/pfring.modules

if [ ! -e /proc/net/pfring ] ; then
    exec /sbin/modprobe pf_ring enable_tx_capture=0 min_num_slots=32768 >/dev/null 2>&1
fi

JustinAzoff

##! Add the peer to the connection logs.

module Conn;

export {
    redef record Conn::Info += {
        peer: string &optional &log;
    };
}

JustinAzoff

module Notice;

export {
    redef enum Action += {
        ACTION_TM_QUERY,
    };

    const tm_query_types: set[Type] = {} &redef;
}