Python sdb Examples

Example #1

def get_alerts():
    s = snortdb.sdb()
    s.setwhere(range='day', span=7)
    #s.where_args=[]
    #s.where='1=1'
    alerts = s.find(sig='WEB-PHP remote include path')
    return alerts

Example #2

File: php_remote_includes.py Project: 7thSpectre/python-snort

def get_alerts():
    s=snortdb.sdb()
    s.setwhere(range='day',span=7)
    #s.where_args=[]
    #s.where='1=1'
    alerts = s.find(sig='WEB-PHP remote include path')
    return alerts

Example #3

File: block_snort.py Project: JustinAzoff/ipblocker

    def get_records(self):
        rules = self.read_rules()
        snort=snortdb.sdb()
        snort.setwhere(range='hour',span=1)
        snort.limit=None

        records = []
        for rule in rules:
            records.extend(self.get_records_for_rule(snort, rule))
        return records

Example #4

    def get_records(self):
        rules = self.read_rules()
        snort = snortdb.sdb()
        snort.setwhere(range='hour', span=1)
        snort.limit = None

        records = []
        for rule in rules:
            records.extend(self.get_records_for_rule(snort, rule))
        return records

Example #5

File: checkup_irc.py Project: killbugs/python-snort

def findirc():
    s=snortdb.sdb()
    s.setwhere()#range='hour',span=24)
    s.setlimit()
    seen = {}
    for x in s.find(data='JOIN #'):
        try :
            line = [l for l in x['data'].splitlines() if 'JOIN' in l and '#' in l][0]
        except IndexError:
            continue
        if ':' in line and '!' in line and '@' in line:
            continue
            
        tup = ( x['ip_src'], x['ip_dst'],  x['dport'], line )
        if tup in seen:
            continue
        seen[tup] = 1
        yield tup

Example #6

File: checkup_proxy.py Project: killbugs/python-snort

#!/usr/bin/env python
import commands

from snort import snortdb

s = snortdb.sdb()
s.setwhere()  #range='hour',span=24)
s.setlimit()


def getproxyips():
    seen = {}
    for x in s.find(sig='TUNNEL'):
        ip = str(x['ip_dst'])
        port = x['dport']
        tup = (ip, port)
        if tup in seen:
            continue
        seen[tup] = 1
        yield tup


def findproxies():
    seen = {}
    for ip, port in getproxyips():
        cmd = "timeout 10 pxytest %s %s" % (ip, port)
        yield ip, commands.getoutput(cmd)


def show():
    for ip, out in findproxies():

Example #7

File: snort_plugin.py Project: JustinAzoff/ninfo_plugins

 def setup(self):
     from snort import snortdb
     self.sdb = snortdb.sdb()
     self.sdb.setlimit(100000)

Example #8

File: test_snort.py Project: killbugs/python-snort

 def test_init(self):
     self.s = snortdb.sdb()

Example #9

File: checkup_proxy.py Project: 7thSpectre/python-snort

#!/usr/bin/env python
import commands

from snort import snortdb

s=snortdb.sdb()
s.setwhere()#range='hour',span=24)
s.setlimit()


def getproxyips():
    seen = {}
    for x in s.find(sig='TUNNEL'):
        ip = str(x['ip_dst'])
        port = x['dport']
        tup = (ip, port)
        if tup in seen:
            continue
        seen[tup]=1
        yield tup

def findproxies():
    seen = {}
    for ip, port in getproxyips():
        cmd  = "timeout 10 pxytest %s %s" % (ip, port) 
        yield ip,  commands.getoutput(cmd)

def show():
    for ip, out in findproxies():
        print ip
        print out

Example #10

File: test_snort.py Project: 7thSpectre/python-snort

 def test_init(self):
     self.s = snortdb.sdb()