top-dns

Top-DNS-Messung Überblick Dieses Skript nutzt einen in Bro integrierten probabilistischen Messmechanismus, um die häufigsten DNS-Anfragen nach Abfragetyp, d. h. CNAME, A, AAAA usw. über einen definierbaren Zeitraum zu messen. Dies wird in einem neuen Log namens „topdns.log“ festgehalten. Durch di...

http-stalling-detector

HTTP Stalling Detector Gli attacchi DoS di stallo HTTP sfruttano l'incapacità dei server web di determinare se un client remoto è semplicemente connesso tramite un collegamento lento o se sta inviando deliberatamente i dati molto lentamente per evitare che il server web esegua un timeout e chiuda...

bro-shellshock

ShellShock Detector für Bro Dieses Skript erkennt die erfolgreiche Ausnutzung der Bash-Sicherheitslücke mit der CVE-Nummer CVE-2014-6271, die den Spitznamen „ShellShock“ trägt. Es ist umfassender als die meisten vorhandenen Erkennungen, da es das Verhalten des angegriffenen Hosts beobachtet, das...

conn-burst

Identificazione delle Connessioni a Raffica Burst Questo pacchetto identifica le "connessioni a raffica" bursting connections, ovvero connessioni che trasferiscono una grande quantità di dati rapidamente. Una volta identificata una connessione a raffica, questa non viene più monitorata come tale...

SweetSecurity

SweetSecurity Script per configurare e installare Bro IDS, Elasticsearch, Logstash, Kibana e Critical Stack su qualsiasi dispositivo. Per maggiori informazioni sull'installazione e su come funziona Sweet Security, consulta la Wiki: https://github.com/TravisFSmith/SweetSecurity/wiki Installazione:...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

Mortimer

Mortimer Eine Sammlung von Skripten zur Verarbeitung von Daten und Intel aus der Netzwerkforensik, hauptsächlich in eine Postgres-Datenbank. Als Open Source von NCC Group Plc veröffentlicht - http://www.nccgroup.com/ Entwickelt für John Green, cirt at nccgroup dot com...

c2finder

c2finder Haftungsausschluss: Ich bin keineswegs ein Meistercoder, daher ist dies ein sehr einfaches Skript. Verlasse dich nicht darauf, dass es perfekt ist. Ich bin offen für Feedback oder Verbesserungsvorschläge : Beschreibung Dieses Skript lädt die Master-C&C-Liste von Bambenek Consulting...

EUVD-2018-8803

Malware in sbrugna...

EUVD-2018-8607

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2018-17019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc. CVE-2018-17019 Note that Nessus relies on the presen...

Linux Distros Unpatched Vulnerability : CVE-2017-1000458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service crash and...

Linux Distros Unpatched Vulnerability : CVE-2018-16807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser. CVE-2018-16807...

CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData...

CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData...

CVE-2023-43955

CVE-2023-43955 affects the com.phlox.tvwebbrowser TV Bro Android app (version 2.0.0 and earlier). The root cause is mishandling of external intents via WebView, enabling an attacker to execute arbitrary code, create arbitrary files, and perform arbitrary downloads using JavaScript that calls take...

Malicious Package

Overview yandex-bro-embedded-site-api is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Denial Of Service (DoS)

Bro is vulnerable to denial of service. The vulnerability exisit in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc...

Null Pointer Dereference

Bro is vulnerable to null pointer dereference. The vulnerability existed because a case-type index is mishandled...

FreeBSD : bro -- invalid memory access or heap buffer over-read (55571619-454e-4769-b1e5-28354659e152)

Jon Siwek of Corelight reports : This is a security patch release to address a potential Denial of Service vulnerability : - The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM...