Skip to content

Instantly share code, notes, and snippets.

Seth Hall sethhall

Block or report user

Report or block sethhall

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
@sethhall
sethhall / http-more-files-names.bro
Created Aug 23, 2018
Get some extra file names from http
View http-more-files-names.bro
redef record HTTP::Info += {
potential_fname: string &optional;
};
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string) &priority=5
{
# Get rid of uri arguments
local path = split_string(c$http$uri, /\?/)[0];
@sethhall
sethhall / icmp-latency.bro
Last active Jan 2, 2016
ICMP Latency Measurement with Bro
View icmp-latency.bro
global watching_icmp: table[conn_id, count] of time &create_expire=3secs;
event icmp_echo_request(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
{
watching_icmp[c$id, seq] = network_time();
}
event icmp_echo_reply(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
{
if ( [c$id, seq] !in watching_icmp )
@sethhall
sethhall / no-cert-parsing.bro
Last active Aug 29, 2015
Script to avoid OpenSSL DoS CVE-2015-1788
View no-cert-parsing.bro
##! This script is to avoid CVE-2015-1788 which is explained in
##! detail at http://jpb.io. It is a denial of service against
##! OpenSSL which will cause Bro processes to lock up.
##! WARNING - This script should only be used temporarily until
##! your OpenSSL library is upgraded. This script can
##! then be removed.
@if( /2\.3/ in bro_version() )
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-100
@sethhall
sethhall / gist:6ec210d99736bd54c351
Last active Aug 29, 2015
fix issue in files framework
View gist:6ec210d99736bd54c351
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index d0b1ea2..c1e5e3d 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -505,10 +505,12 @@ void File::EndOfFile()
if ( ! bof_buffer.full )
{
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] File over but bof_buffer not full.", id.c_str());
- bof_buffer.full = true;
+ bof_buffer.full = true;
@sethhall
sethhall / gif.pac2
Created Oct 20, 2014
very early gif parser for binpac++. probably doesn't even work.
View gif.pac2
module GIF;
import BinPAC;
type Header = unit {
%byteorder = BinPAC::ByteOrder::Little;
signature : bytes &length=3; #This needs to either be a literal b"GIF" or have a &check attribute when that exists
version : bytes &length=3;
@sethhall
sethhall / ident-files.bro
Created Oct 6, 2014
File identification script.
View ident-files.bro
const DIR="" &redef;
@load base/utils/dir
@load frameworks/files/hash-all-files
redef exit_only_after_terminate=T;
event bro_init()
{
View gist:8b774afd4946757c93f8
# Jason Batchelor Edits, 9/19/2014
# Signatures informed by the following resource
# http://www.garykessler.net/library/file_sigs.html
signature file-olecf {
file-magic /(\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1)/
file-mime "application/olecf", 150
}
signature file-ooxml {
file-magic /(\x50\x4b\x03\x04\x14\x00\x06\x00)/
file-mime "application/vnd.openxmlformats-officedocument", 100
View keybase.md

Keybase proof

I hereby claim:

  • I am sethhall on github.
  • I am remor (https://keybase.io/remor) on keybase.
  • I have a public key whose fingerprint is 421B 904C FF8C 56F0 D94C 88EB C4B7 768B D10C DBD5

To claim this, I am signing this object:

View bro-exchange-update-watcher.bro
redef exit_only_after_terminate = T;
module BroExchangeWatch;
export {
redef enum Notice::Type += {
Woo,
};
}
You can’t perform that action at this time.