Skip to content

Instantly share code, notes, and snippets.

View inliniac's full-sized avatar

Victor Julien inliniac

View GitHub Profile
static int HTPCallbackRequest(htp_tx_t *tx) {
SCEnter();
HtpState *hstate = htp_connp_get_user_data(tx->connp);
if (hstate == NULL) {
SCReturnInt(HTP_ERROR);
}
SCLogDebug("transaction_cnt %"PRIu64", list_size %"PRIu64,
hstate->transaction_cnt, HTPStateGetTxCnt(hstate));
input {
lumberjack {
# The port to listen on
port => 5043
# The paths to your ssl cert and key
ssl_certificate => "/etc/logstash/pki/lumberjack.pub"
ssl_key => "/etc/logstash/pki/lumberjack.key"
# Set this to whatever you want.
@inliniac
inliniac / Print unique request header names
Created March 19, 2014 17:53
Lua output scripts for Suricata
function init (args)
local needs = {}
needs["protocol"] = "http"
return needs
end
function setup (args)
sqlite3, errmsg = require("lsqlite3")
db = sqlite3.open_memory()
db:exec[[CREATE TABLE headers (id INTEGER PRIMARY KEY, header);]]
@inliniac
inliniac / logstash-forwarder.conf
Created March 25, 2014 16:40
Logstash Suricata configs
{
"network": {
"servers": [ "x.x.x.x:5043" ],
"ssl certificate": "./lumberjack.pub",
"ssl key": "./lumberjack.key",
"ssl ca": "./lumberjack.pub"
},
"files": [
{
"paths": [ "/var/log/suricata/eve.json" ],
@inliniac
inliniac / headers_db.lua
Created July 29, 2014 11:58
Lua output script for Suricata
function init (args)
local needs = {}
needs["protocol"] = "http"
return needs
end
function setup (args)
sqlite3, errmsg = require("lsqlite3")
db = sqlite3.open_memory()
db:exec[[CREATE TABLE headers (id INTEGER PRIMARY KEY, header);]]

Keybase proof

I hereby claim:

  • I am inliniac on github.
  • I am inliniac (https://keybase.io/inliniac) on keybase.
  • I have a public key whose fingerprint is 1DBF 0366 7457 EB6A ED9E 0DF9 C1F4 95E3 9268 56B4

To claim this, I am signing this object:

@inliniac
inliniac / tls-sni.lua
Created February 24, 2016 10:53
TLS-SNI Lua detection example
function init (args)
local needs = {}
needs["tls"] = tostring(true)
return needs
end
function match(args)
sni = TlsGetSNI();
if sni == nil then
return 0
@inliniac
inliniac / smtp-output.lua
Created July 12, 2016 15:46
Simple lua output script I use in QA
function init (args)
local needs = {}
needs["protocol"] = "smtp"
return needs
end
function setup (args)
smtp = 0
filename = SCLogPath() .. "/smtp-lua.log"
SCLogInfo(filename);
@inliniac
inliniac / smtp-output.lua
Created July 12, 2016 15:58
QA smtp lua script
function init (args)
local needs = {}
needs["protocol"] = "smtp"
return needs
end
function setup (args)
smtp = 0
filename = SCLogPath() .. "/smtp-lua.log"
SCLogInfo(filename);
segments:
- size: 4
prealloc: 256
- size: 16
prealloc: 512
- size: 112
prealloc: 512
- size: 248
prealloc: 512
- size: 512