[Bro] Learning the Bro Scripting Language Part 3 - Detecting basic auth and going from evidence to practical use in Bro
vallentin at icir.org
Fri May 4 12:09:57 PDT 2012
> I sent the first post of the series to the mailing list and got a
> decent response from people who were interested in learning Bro's
> scripting language.
Nice work, Scott!
One small comment: "Three lines of Bro's scripting language and we can
detect a server using Basic Access Authentication!"
It's actually just one line :
redef HTTP::default_capture_password = T;
This automatically creates a new column password in the http.log with
the password value, if available.
Keep the posts coming!
More information about the Bro