http-stalling-detector

HTTP Stalling Detector HTTP 停滞型 DoS 攻击利用的是 Web 服务器无法判断远程客户端仅仅是连接在慢速链路上，还是故意以非常慢的速度发送数据，以避免 Web 服务器因超时而关闭连接以保留本地系统资源。攻击者通常表现出的行为是打开大量连接，并缓慢地吐出数据，以防止 Web 服务器将连接超时。如果 Web 服务器使用的工作进程池较小，这种资源耗尽很容易达到。 许多现代 Web 服务器已经对这些类型的资源耗尽攻击有了更强的防御能力，但关注这些攻击仍然很重要，而且很有可能在生产网络中仍然存在大量易受攻击的 Web 服务器。Web...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

SweetSecurity

SweetSecurity 用于在任何设备上设置和安装 Bro IDS、Elasticsearch、Logstash、Kibana 和 Critical Stack 的脚本。 如需了解更多关于安装和 Sweet Security 工作原理的信息，请参阅 Wiki： https://github.com/TravisFSmith/SweetSecurity/wiki 安装： sudo python setup.py 根据提示为所选安装类型输入相应信息 新增功能： 模块化安装 - 可选择将所有工具部署在一台设备上，或拆分为多台设备以提升性能。 完整安装 - 部署 Bro IDS、Critic...

Mortimer

Mortimer Una colección de scripts para procesar datos y threat intelligence de tipo forensia de red, principalmente en una base de datos postgres. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado para John Green, cirt at nccgroup dot com...

c2finder

c2finder 强制免责声明：我绝不是一位编程大师，所以这只是一个非常简单的脚本。不要指望它是完美的。不过，我欢迎任何反馈或改进建议 ： 描述 该脚本从 Bambenek Consulting http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt 下载主 C&C 列表，对其进行解析，并在 Bro 日志中搜索 C&C IP 的出现情况。它将包含 C&C IP 的 Bro 条目分别保存到每个 IP 对应的单独文件中，并将其自身输出保存到名为 c2finderdate.log 格式的日志文件中。 使用示例...

bro-shellshock

用于 Bro 的 ShellShock 检测器 这个脚本用于检测 Bash 漏洞（CVE-2014-6271，绰号 “ShellShock”）被成功利用的情况。它比目前大多数检测方案更全面，因为它会监视被攻击主机的行为，以判断其是否可能已被成功入侵，或是否确实存在漏洞。 如果发现某台主机通过 HTTP 收到攻击，Bro 会监视该主机是否会下载投放器（dropper）载荷或发送 ICMP ping。还可能出现更多响应机制，但这已足以覆盖目前大多数已知的响应机制。默认情况下，此脚本配置为监视 MIME 类型为 application/x-executable...

conn-burst

连接突发识别 此软件包用于识别“突发连接”（即快速传输大量数据的连接）。一旦某个连接被识别为突发连接，将不再对其继续监控突发性。 当识别出突发连接时，将生成事件 ConnBurst::detected，并向名为 connburst 的日志流写入一条日志。 安装 root@kitploit: bro-pkg refresh bro-pkg install bro/corelight/conn-burst 配置 有几个配置选项可能会影响分析和检测。 ConnBurst::speedthreshold —— 这是一个以 Mbps 为单位的 double...

top-dns

Top DNS 测量 概述 此脚本利用 Bro 中内置的概率测量机制，在可定义的时间段内测量最热门的 DNS 请求（按查询类型，例如 CNAME、A、AAAA 等）。这些结果会记录到一个名为 "topdns.log" 的新日志中。 通过使用概率机制，它可以以内存高效的方式完成此任务，并且加载此脚本不会对大多数部署产生真正显著的性能影响。 安装 :: root@kitploit: bro-pkg refresh bro-pkg install bro/corelight/top-dns 配置 如果您想更改日志记录/测量间隔，请使用以下代码片段（默认为 15 分钟）：:...

EUVD-2018-8607

Malware in sbrugna...

EUVD-2018-8803

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2018-17019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc. CVE-2018-17019 Note that Nessus relies on the presen...

Linux Distros Unpatched Vulnerability : CVE-2017-1000458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service crash and...

Linux Distros Unpatched Vulnerability : CVE-2018-16807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser. CVE-2018-16807...

CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData...

CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData...

CVE-2023-43955

CVE-2023-43955 affects the com.phlox.tvwebbrowser TV Bro Android app (version 2.0.0 and earlier). The root cause is mishandling of external intents via WebView, enabling an attacker to execute arbitrary code, create arbitrary files, and perform arbitrary downloads using JavaScript that calls take...

Malicious Package

Overview yandex-bro-embedded-site-api is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Denial Of Service (DoS)

Bro is vulnerable to denial of service. The vulnerability exisit in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc...

Null Pointer Dereference

Bro is vulnerable to null pointer dereference. The vulnerability existed because a case-type index is mishandled...

FreeBSD : bro -- invalid memory access or heap buffer over-read (55571619-454e-4769-b1e5-28354659e152)

Jon Siwek of Corelight reports : This is a security patch release to address a potential Denial of Service vulnerability : - The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM...