Skip to content

Instantly share code, notes, and snippets.

@johnnykv

johnnykv/gist:9170360

Created February 23, 2014 11:49
Show Gist options
  • Save johnnykv/9170360 to your computer and use it in GitHub Desktop.
Save johnnykv/9170360 to your computer and use it in GitHub Desktop.
Download ZIP
Glastopf_Stix_Sample.xml
Raw
gistfile1.xml
<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
xmlns:TTP="http://stix.mitre.org/TTP-1"
xmlns:Glastopf="http://glastopf.org/stix-1"
xsi:schemaLocation="http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.0.1/stix_core.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.0.1/stix_common.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.0.1/incident.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.0.1/cybox_core.xsd
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.0.1/cybox_common.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.0.1/Address_Object.xsd
http://cybox.mitre.org/objects#PortObject-2 http://cybox.mitre.org/XMLSchema/objects/Port/2.0.1/Port_Object.xsd
http://cybox.mitre.org/objects#SocketAddressObject-1 http://cybox.mitre.org/XMLSchema/objects/Socket_Address/1.0.1/Socket_Address_Object.xsd
http://cybox.mitre.org/objects#NetworkConnectionObject-2 http://cybox.mitre.org/XMLSchema/objects/Network_Connection/2.0.1/Network_Connection_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.0.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#ArtifactObject-2 http://cybox.mitre.org/XMLSchema/objects/Artifact/2.0.1/Artifact_Object.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.0.1/ttp.xsd"
id="Glastopf:STIXPackage-7e97224d-8398-42cd-ae05-8a8caff45a17" version="1.0.1">
<stix:STIX_Header>
<stix:Title>Unauthorized traffic to honeypot</stix:Title>
<stix:Description>Describes one or more honeypot incidents</stix:Description>
<stix:Information_Source>
<stixCommon:Time>
<cyboxCommon:Produced_Time>2014-02-23T11:47:22.780708</cyboxCommon:Produced_Time>
</stixCommon:Time>
</stix:Information_Source>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id="Glastopf:Incident-36bc34e2-6a09-47d0-94cf-a595a7088f6e" xsi:type='incident:IncidentType'>
<incident:Time>
<incident:First_Malicious_Action>2014-02-23T12:47:22</incident:First_Malicious_Action>
</incident:Time>
<incident:Description>Traffic to Glastopf honeypot</incident:Description>
<incident:Categories>
<incident:Category>Scans/Probes/Attempted Access</incident:Category>
</incident:Categories>
<incident:Reporter>
<stixCommon:Tools>
<cyboxCommon:Tool>
<cyboxCommon:Name>Glastopf</cyboxCommon:Name>
<cyboxCommon:Type>Honeypot</cyboxCommon:Type>
<cyboxCommon:Description>Glastopf is a Honeypot which emulates thousands of vulnerabilities to
gather data from attacks targeting web applications.
</cyboxCommon:Description>
<cyboxCommon:References>
<cyboxCommon:Reference reference_type="Source">https://github.com/glastopf/glastopf
</cyboxCommon:Reference>
<cyboxCommon:Reference reference_type="Other">http://glastopf.org/</cyboxCommon:Reference>
</cyboxCommon:References>
<cyboxCommon:Version>3.1.3-dev</cyboxCommon:Version>
</cyboxCommon:Tool>
</stixCommon:Tools>
</incident:Reporter>
<incident:Related_Observables>
<incident:Related_Observable>
<!-- Reconsider this - any better way to put the observable into context? -->
<stixCommon:Relationship>HTTP Request</stixCommon:Relationship>
<stixCommon:Observable id="Glastopf:Observable-">
<cybox:Object>
<cybox:Properties xsi:type="NetworkConnectionObj:NetworkConnectionObjectType">
<NetworkConnectionObj:Layer3_Protocol datatype="string">IPv4
</NetworkConnectionObj:Layer3_Protocol>
<NetworkConnectionObj:Layer4_Protocol datatype="string">TCP
</NetworkConnectionObj:Layer4_Protocol>
<NetworkConnectionObj:Layer7_Protocol datatype="string">HTTP
</NetworkConnectionObj:Layer7_Protocol>
<NetworkConnectionObj:Source_Socket_Address>
<SocketAddressObj:IP_Address category="ipv4-addr" is_source="true">
<AddressObj:Address_Value>127.0.0.1</AddressObj:Address_Value>
</SocketAddressObj:IP_Address>
<SocketAddressObj:Port>
<PortObj:Port_Value>58185</PortObj:Port_Value>
</SocketAddressObj:Port>
</NetworkConnectionObj:Source_Socket_Address>
<NetworkConnectionObj:Layer7_Connections>
<NetworkConnectionObj:HTTP_Session>
<HTTPSessionObj:HTTP_Request_Response>
<HTTPSessionObj:HTTP_Client_Request>
<HTTPSessionObj:HTTP_Request_Line>
<HTTPSessionObj:HTTP_Method datatype="string">GET
</HTTPSessionObj:HTTP_Method>
<HTTPSessionObj:Value>/id%3Danything%27%20OR%20%27x%27%3D%27x%27
</HTTPSessionObj:Value>
<HTTPSessionObj:Version>HTTP/1.1</HTTPSessionObj:Version>
</HTTPSessionObj:HTTP_Request_Line>
<HTTPSessionObj:HTTP_Request_Header>
<HTTPSessionObj:Raw_Header>Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,da;q=0.6
Cache-Control: max-age=0
Connection: keep-alive
Cookie: _ga=1.1.2109719261.1367355212; path=/;
session=.eJw9zkELgjAYxvGvMt5zBGVdhC4hRcFeE2ZDI0TXcrqp0QTN8LsXFZ2e2-_5PyG5mtQqacE9PYG038nAhYwfBzHf1HGwWsE4gYORqZXENDkpatI2JBVCWktaVVhyS3M5hfN4nkBSXMD9GciDB5ZKYZnPaKkdZNEDedhhddTI1oYy2vse6piJz4ew92vSNlrWfyJiGxWX4YLyvXkTnc93ju_pHqvAQR7N6RD2_pbO0Is6yvSSDlh9k8cX865H6w.BerT0A.0rbvV0n9ffs5-YTZefd2F7GtS0o
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107
Safari/537.36
</HTTPSessionObj:Raw_Header>
<HTTPSessionObj:Parsed_Header>
<HTTPSessionObj:Accept_Language>en-US,en;q=0.8,da;q=0.6
</HTTPSessionObj:Accept_Language>
<HTTPSessionObj:Accept_Encoding>gzip,deflate,sdch
</HTTPSessionObj:Accept_Encoding>
<HTTPSessionObj:Host>localhost</HTTPSessionObj:Host>
<HTTPSessionObj:Accept>
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
</HTTPSessionObj:Accept>
<HTTPSessionObj:User_Agent>Mozilla/5.0 (Macintosh; Intel Mac OS
X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/32.0.1700.107 Safari/537.36
</HTTPSessionObj:User_Agent>
<HTTPSessionObj:Connection>keep-alive
</HTTPSessionObj:Connection>
<HTTPSessionObj:Cookie>_ga=1.1.2109719261.1367355212; path=/;
session=.eJw9zkELgjAYxvGvMt5zBGVdhC4hRcFeE2ZDI0TXcrqp0QTN8LsXFZ2e2-_5PyG5mtQqacE9PYG038nAhYwfBzHf1HGwWsE4gYORqZXENDkpatI2JBVCWktaVVhyS3M5hfN4nkBSXMD9GciDB5ZKYZnPaKkdZNEDedhhddTI1oYy2vse6piJz4ew92vSNlrWfyJiGxWX4YLyvXkTnc93ju_pHqvAQR7N6RD2_pbO0Is6yvSSDlh9k8cX865H6w.BerT0A.0rbvV0n9ffs5-YTZefd2F7GtS0o
</HTTPSessionObj:Cookie>
<HTTPSessionObj:Cache_Control>max-age=0
</HTTPSessionObj:Cache_Control>
</HTTPSessionObj:Parsed_Header>
</HTTPSessionObj:HTTP_Request_Header>
<HTTPSessionObj:HTTP_Message_Body>
<HTTPSessionObj:Message_Body></HTTPSessionObj:Message_Body>
</HTTPSessionObj:HTTP_Message_Body>
</HTTPSessionObj:HTTP_Client_Request>
</HTTPSessionObj:HTTP_Request_Response>
</NetworkConnectionObj:HTTP_Session>
</NetworkConnectionObj:Layer7_Connections>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
</incident:Related_Observables>
<incident:Leveraged_TTPs>
<incident:Leveraged_TTP>
<stixCommon:TTP xsi:type="TTP:TTPType">
<TTP:Behavior>
<TTP:Attack_Patterns>
<TTP:Attack_Pattern capec_id="CAPEC-66">
<TTP:Description>SQL Injection</TTP:Description>
</TTP:Attack_Pattern>
</TTP:Attack_Patterns>
</TTP:Behavior>
</stixCommon:TTP>
</incident:Leveraged_TTP>
</incident:Leveraged_TTPs>
</stix:Incident>
</stix:Incidents>
</stix:STIX_Package>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment