Skip to content

Instantly share code, notes, and snippets.

@inliniac
Created July 29, 2014 11:58
Show Gist options
  • Save inliniac/f0ecc5cc37433576b9af to your computer and use it in GitHub Desktop.
Save inliniac/f0ecc5cc37433576b9af to your computer and use it in GitHub Desktop.
Lua output script for Suricata
function init (args)
local needs = {}
needs["protocol"] = "http"
return needs
end
function setup (args)
sqlite3, errmsg = require("lsqlite3")
db = sqlite3.open_memory()
db:exec[[CREATE TABLE headers (id INTEGER PRIMARY KEY, header);]]
end
function log(args)
a = HttpGetRequestHeaders();
for n, v in pairs(a) do
local stmt = db:prepare[[ INSERT INTO headers VALUES (:key, :header) ]]
stmt:bind_names{ key = NULL, header = n}
stmt:step()
stmt:finalize()
end
end
function deinit (args)
print ("Request Headers:")
for row in db:nrows("SELECT header, COUNT(*) as count FROM headers GROUP BY header") do
print(row.count, row.header)
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment