Skip to content

Instantly share code, notes, and snippets.

View jeffgeiger's full-sized avatar

Jeff Geiger jeffgeiger

37 followers · 5 following
View GitHub Profile
@jeffgeiger
jeffgeiger / grokproduce.sh
Last active December 22, 2015 14:39
Generate named grok filters and a stub config from bro log headers on the fly. `cd` to your Bro logs directory and run this.
#!/bin/bash
TSTAMP=$(date +%s)
CONF="/tmp/logstash-$TSTAMP.conf"
PATTERNS="/tmp/bro_patterns_$TSTAMP"
for j in *.log; do
LOG=$(echo $j | sed 's/.log//g')
FILTNAME=$(echo $LOG | tr '[:lower:]' '[:upper:]')
echo -e "BRO$FILTNAME \c" >> $PATTERNS
@jeffgeiger
jeffgeiger / update_bro_intel.sh
Created September 10, 2013 03:48
Pull JSON data from elasticinsight to update Bro intel indicators file. Uses "jq" from http://stedolan.github.io/jq
#!/bin/bash
INTELFILE=$1
DOC=$(curl -# http://elasticinsight-test/ElasticAPI/BroIntelFrameworkIndicatorList 2> /dev/null)
RECS=$(echo $DOC | jq '. | length')
j=0
HEADER=$(grep -E "^#" $INTELFILE)
echo "$HEADER" > $INTELFILE
@jeffgeiger
jeffgeiger / custom.sh
Last active December 23, 2015 03:18
Bro functions and aliases
alias bro-column="sed \"s/fields.//;s/types.//\" | column -s $'\t' -t"
alias bro-awk='awk -F" "'
bro-grep() { grep -E "(^#)|$1" $2; }
bro-zgrep() { zgrep -E "(^#)|$1" $2; }
topcount() { sort | uniq -c | sort -rn | head -n ${1:-10}; }
colorize() { sed 's/#fields\t\|#types\t/#/g' | awk 'BEGIN {FS="\t"};{for(i=1;i<=NF;i++) printf("\x1b[%sm %s \x1b[0m",(i%7)+31,$i);print ""}'; }
cm() { cat $1 | sed 's/#fields\t\|#types\t/#/g' | awk 'BEGIN {FS="\t"};{for(i=1;i<=NF;i++) printf("\x1b[%sm %s \x1b[0m",(i%7)+31,$i);print ""}'; }
lesscolor() { cat $1 | sed 's/#fields\t\|#types\t/#/g' | awk 'BEGIN {FS="\t"};{for(i=1;i<=NF;i++) printf("\x1b[%sm %s \x1b[0m",(i%7)+31,$i);print ""}' | less -RS; }
topconn() { if [ $# -lt 2 ]; then echo "Usage: topconn {resp|orig} {proto|service} {tcp|udp|icmp|http|dns|ssl|smtp|\"-\"}"; else cat conn.log | bro-cut id.$1_h $2 | grep $3 | topcount; fi; }
fields() { grep -m 1 -E "^#fields" $1 | awk -vRS='\t' '/^[^#]/ { print $1 }' | cat -n ; }
@jeffgeiger
jeffgeiger / spam_functions.sh
Created September 25, 2013 19:25
Shell functions to help clean up postfix after compromised credentials are used for spamming.
whackspam() { if [ $# -lt 1 ]; then echo "Usage: whackspam <sasl_username>"; else for j in $(for i in $(grep sasl_username=$1 maillog | awk -F'[][]' '{print $4}' | sort -u); do netstat -na | grep $i | awk '{print $5}' | awk -F: '{print $1}'; done); do perl -e "alarm 7; exec @ARGV" "tcpkill -i vlan102 -9 host $j"; done; fi; }
cleanqueue() { if [ $# -lt 1 ]; then echo "Usage: cleanqueue <search term>"; else for i in $(mailq -bpc | grep $1 | egrep -v "^ " | awk '{print $1}'); do postsuper -d $i; done; fi; }
@jeffgeiger
jeffgeiger / dns_anomaly.sh
Created June 29, 2014 02:23
DNS Anomaly Detection
#!/bin/bash
export PATH=/opt/bro/bin:$PATH
BRO_LOGS="/nsm/bro/logs"
TODAY=`date +%Y-%m-%d`
YESTERDAY=`date -d yesterday +%Y-%m-%d`
OLD_DIRS=`ls $BRO_LOGS |egrep -v "current|stats|$TODAY|$YESTERDAY"`
TMPDIR=/tmp
OLDLOG=$TMPDIR/oldlog
NEWLOG=$TMPDIR/newlog
@jeffgeiger
jeffgeiger / gist:0397041a12f6b48cb494
Last active August 29, 2015 14:03
Messages Backup
sqlite3 /Users/$USER/Library/Messages/chat.db <<EOF
.mode line
select ROWID, text, datetime(date, 'unixepoch', 'localtime') as date from message where handle_id = (select ROWID from handle where id = "+12223334444");
EOF
@jeffgeiger
jeffgeiger / gist:75cfeeecbd802e82e7bc
Created October 7, 2014 21:44
OSX Password Prompt
#Cred to: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html
osascript -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to display dialog "Software Update requires that you type your password to apply changes." & return & return default answer "" with icon 1 with hidden answer with title "Software Update"'
@jeffgeiger
jeffgeiger / update_blacklist.sh
Created October 15, 2014 13:30
Update IPTables with IP's from OpenBL
#!/bin/bash
CHAINLIST=$(/sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d\ -f 2)
if [ -z $CHAINLIST ]; then
/sbin/iptables -N block-traffic-from-openbl
/sbin/iptables -A INPUT -j block-traffic-from-openbl
fi
BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | egrep "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")
@jeffgeiger
jeffgeiger / etc_sysconfig_netsniff-ng
Last active October 20, 2017 06:33
example systemd script for netsniff-ng
PROM_INTERFACE=enp0s8
USER=99
GROUP=99
INTERVAL=5min
DATA_DIR=/pcap/
@jeffgeiger
jeffgeiger / rock_rotate.sh
Last active August 29, 2015 14:10
Cleanup script for files and logs in ROCK
#!/bin/bash
DATEDIR=$(date +%Y-%m-%d_%H:%M:00)
BRO_FILES_DIR="/capes/bro/extract"
BRO_FILES_ARCHIVE="/capes/bro/extract/${DATEDIR}"
PCAP_FILES_DIR="/pcap/"
PCAP_FILES_ARCHIVE="/pcap/${DATEDIR}"
mkdir -p $BRO_FILES_ARCHIVE
mkdir -p $PCAP_FILES_ARCHIVE