{"action":"created","comment":{"url":"https://api.github.com/repos/mushorg/tanner/pulls/comments/67599840","id":67599840,"diff_hunk":"@@ -0,0 +1,109 @@\n+import pickle\n+\n+import redis\n+import json\n+import asyncio\n+import socket\n+import operator\n+\n+\n+class SessionAnalyzer:\n+    def __init__(self):\n+        self.r = redis.StrictRedis(host='localhost', port=6379)\n+\n+    @asyncio.coroutine\n+    def analyze(self):\n+        session = None\n+        session_key = yield\n+        try:\n+            session = self.r.get(session_key)\n+            session = json.loads(session.decode('utf-8'))\n+        except (redis.ConnectionError, TypeError) as e:\n+            pass\n+        stats = self.create_stats(session)\n+        return stats\n+\n+    def create_stats(self, session):\n+        sess_duration = session['end_time'] - session['start_time']\n+        rps = sess_duration / session['count']\n+        tbr, errors, hidden_links, attack_types = self.analyze_paths(session['paths'])\n+\n+        stats = dict(\n+            uuid=session['uuid'],\n+            peer_ip=session['peer']['ip'],\n+            peer_port=session['peer']['port'],\n+            user_agent=session['user_agent'],\n+            sensor_uuid=session['sensor'],\n+            start_time=session['start_time'],\n+            end_time=session['end_time'],\n+            requests_in_second=rps,\n+            approx_time_between_requests=tbr,\n+            accepted_paths=session['count'],\n+            errors=errors,\n+            hidden_links=hidden_links,\n+            attack_types=attack_types,\n+            paths=session['paths']\n+        )\n+\n+        owner = self.choose_possible_owner(stats)\n+        stats.update(owner)\n+\n+        return stats\n+\n+    def analyze_paths(self, paths):\n+        tbr = []\n+        attack_types = set()\n+        current_path = paths[0]\n+        with open('dorks.pickle', 'rb') as fh:\n+            dorks = pickle.load(fh)\n+\n+        for i, path in enumerate(paths, start=1):\n+            tbr.append(path['timestamp'] - current_path['timestamp'])\n+            current_path = path\n+        tbr_average = sum(tbr) / float(len(tbr))\n+\n+        errors = 0\n+        hidden_links = 0\n+        for path in paths:\n+            if path['response_status'] is not 200:\n+                errors += 1\n+            if path['path'] in dorks:","path":"session_analyzer.py","position":70,"original_position":70,"commit_id":"5b7b2b2b459a9a38405b77c2601b805025114c0a","original_commit_id":"5b7b2b2b459a9a38405b77c2601b805025114c0a","user":{"login":"glaslos","id":716339,"avatar_url":"https://avatars.githubusercontent.com/u/716339?v=3","gravatar_id":"","url":"https://api.github.com/users/glaslos","html_url":"https://github.com/glaslos","followers_url":"https://api.github.com/users/glaslos/followers","following_url":"https://api.github.com/users/glaslos/following{/other_user}","gists_url":"https://api.github.com/users/glaslos/gists{/gist_id}","starred_url":"https://api.github.com/users/glaslos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glaslos/subscriptions","organizations_url":"https://api.github.com/users/glaslos/orgs","repos_url":"https://api.github.com/users/glaslos/repos","events_url":"https://api.github.com/users/glaslos/events{/privacy}","received_events_url":"https://api.github.com/users/glaslos/received_events","type":"User","site_admin":false},"body":"This is really cool! :)","created_at":"2016-06-18T11:37:18Z","updated_at":"2016-06-18T11:37:18Z","html_url":"https://github.com/mushorg/tanner/pull/41#discussion_r67599840","pull_request_url":"https://api.github.com/repos/mushorg/tanner/pulls/41","_links":{"self":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/comments/67599840"},"html":{"href":"https://github.com/mushorg/tanner/pull/41#discussion_r67599840"},"pull_request":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/41"}}},"pull_request":{"url":"https://api.github.com/repos/mushorg/tanner/pulls/41","id":74167360,"html_url":"https://github.com/mushorg/tanner/pull/41","diff_url":"https://github.com/mushorg/tanner/pull/41.diff","patch_url":"https://github.com/mushorg/tanner/pull/41.patch","issue_url":"https://api.github.com/repos/mushorg/tanner/issues/41","number":41,"state":"open","locked":false,"title":"Session evaluation","user":{"login":"afeena","id":8390928,"avatar_url":"https://avatars.githubusercontent.com/u/8390928?v=3","gravatar_id":"","url":"https://api.github.com/users/afeena","html_url":"https://github.com/afeena","followers_url":"https://api.github.com/users/afeena/followers","following_url":"https://api.github.com/users/afeena/following{/other_user}","gists_url":"https://api.github.com/users/afeena/gists{/gist_id}","starred_url":"https://api.github.com/users/afeena/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afeena/subscriptions","organizations_url":"https://api.github.com/users/afeena/orgs","repos_url":"https://api.github.com/users/afeena/repos","events_url":"https://api.github.com/users/afeena/events{/privacy}","received_events_url":"https://api.github.com/users/afeena/received_events","type":"User","site_admin":false},"body":"- Added the basic tool to evaluate the session. \r\n- Fixed session fields.\r\n- Added test for the session evaluation tool.\r\n\r\nExample result of the evaluation:\r\n\r\n```json\r\n{  \r\n    \"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2767.4 Safari/537.36\",\r\n    \"possible_owners\":[  \r\n        \"attacker\"\r\n    ],\r\n    \"errors\":0,\r\n    \"start_time\":1466091813.4780173,\r\n    \"hidden_links\":0,\r\n    \"uuid\":\"c546114f97f548f982756495f963e280\",\r\n    \"sensor_uuid\":\"78e51180-bf0d-4757-8a04-f000e5efa179\",\r\n    \"paths\":[  \r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091813.4779778,\r\n            \"attack_type\":\"index\",\r\n            \"path\":\"/\"\r\n        },\r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091842.7088752,\r\n            \"attack_type\":\"index\",\r\n            \"path\":\"/fluent-python.html\"\r\n        },\r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091858.214475,\r\n            \"attack_type\":\"index\",\r\n            \"path\":\"/wow-movie.html?exec=/bin/bash\"\r\n        },\r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091871.9076045,\r\n            \"attack_type\":\"lfi\",\r\n            \"path\":\"/wow-movie.html?exec=/etc/passwd\"\r\n        },\r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091885.1003792,\r\n            \"attack_type\":\"index\",\r\n            \"path\":\"/wow-movie.html?exec=/bin/bash\"\r\n        },\r\n        {  \r\n            \"response_status\":200,\r\n            \"timestamp\":1466091899.9854052,\r\n            \"attack_type\":\"lfi\",\r\n            \"path\":\"/wow-movie.html?exec=/../../../..///././././.../../../etc/passwd\"\r\n        }\r\n    ],\r\n    \"peer_ip\":\"192.168.1.3\",\r\n    \"accepted_paths\":24,\r\n    \"approx_time_between_requests\":14.417904575665792,\r\n    \"requests_in_second\":3.604474425315857,\r\n    \"attack_types\":[  \r\n        \"index\",\r\n        \"lfi\"\r\n    ],\r\n    \"end_time\":1466091899.9854035,\r\n    \"peer_port\":56970\r\n}\r\n```\r\n\r\n\r\n\r\n","created_at":"2016-06-16T23:13:43Z","updated_at":"2016-06-18T11:37:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cd01ac9f8fa73bf521af4b3349e542e5941a73f2","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mushorg/tanner/pulls/41/commits","review_comments_url":"https://api.github.com/repos/mushorg/tanner/pulls/41/comments","review_comment_url":"https://api.github.com/repos/mushorg/tanner/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mushorg/tanner/issues/41/comments","statuses_url":"https://api.github.com/repos/mushorg/tanner/statuses/5b7b2b2b459a9a38405b77c2601b805025114c0a","head":{"label":"afeena:session-evaluation","ref":"session-evaluation","sha":"5b7b2b2b459a9a38405b77c2601b805025114c0a","user":{"login":"afeena","id":8390928,"avatar_url":"https://avatars.githubusercontent.com/u/8390928?v=3","gravatar_id":"","url":"https://api.github.com/users/afeena","html_url":"https://github.com/afeena","followers_url":"https://api.github.com/users/afeena/followers","following_url":"https://api.github.com/users/afeena/following{/other_user}","gists_url":"https://api.github.com/users/afeena/gists{/gist_id}","starred_url":"https://api.github.com/users/afeena/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afeena/subscriptions","organizations_url":"https://api.github.com/users/afeena/orgs","repos_url":"https://api.github.com/users/afeena/repos","events_url":"https://api.github.com/users/afeena/events{/privacy}","received_events_url":"https://api.github.com/users/afeena/received_events","type":"User","site_admin":false},"repo":{"id":56975208,"name":"tanner","full_name":"afeena/tanner","owner":{"login":"afeena","id":8390928,"avatar_url":"https://avatars.githubusercontent.com/u/8390928?v=3","gravatar_id":"","url":"https://api.github.com/users/afeena","html_url":"https://github.com/afeena","followers_url":"https://api.github.com/users/afeena/followers","following_url":"https://api.github.com/users/afeena/following{/other_user}","gists_url":"https://api.github.com/users/afeena/gists{/gist_id}","starred_url":"https://api.github.com/users/afeena/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afeena/subscriptions","organizations_url":"https://api.github.com/users/afeena/orgs","repos_url":"https://api.github.com/users/afeena/repos","events_url":"https://api.github.com/users/afeena/events{/privacy}","received_events_url":"https://api.github.com/users/afeena/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/afeena/tanner","description":"He who flays the hide","fork":true,"url":"https://api.github.com/repos/afeena/tanner","forks_url":"https://api.github.com/repos/afeena/tanner/forks","keys_url":"https://api.github.com/repos/afeena/tanner/keys{/key_id}","collaborators_url":"https://api.github.com/repos/afeena/tanner/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/afeena/tanner/teams","hooks_url":"https://api.github.com/repos/afeena/tanner/hooks","issue_events_url":"https://api.github.com/repos/afeena/tanner/issues/events{/number}","events_url":"https://api.github.com/repos/afeena/tanner/events","assignees_url":"https://api.github.com/repos/afeena/tanner/assignees{/user}","branches_url":"https://api.github.com/repos/afeena/tanner/branches{/branch}","tags_url":"https://api.github.com/repos/afeena/tanner/tags","blobs_url":"https://api.github.com/repos/afeena/tanner/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/afeena/tanner/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/afeena/tanner/git/refs{/sha}","trees_url":"https://api.github.com/repos/afeena/tanner/git/trees{/sha}","statuses_url":"https://api.github.com/repos/afeena/tanner/statuses/{sha}","languages_url":"https://api.github.com/repos/afeena/tanner/languages","stargazers_url":"https://api.github.com/repos/afeena/tanner/stargazers","contributors_url":"https://api.github.com/repos/afeena/tanner/contributors","subscribers_url":"https://api.github.com/repos/afeena/tanner/subscribers","subscription_url":"https://api.github.com/repos/afeena/tanner/subscription","commits_url":"https://api.github.com/repos/afeena/tanner/commits{/sha}","git_commits_url":"https://api.github.com/repos/afeena/tanner/git/commits{/sha}","comments_url":"https://api.github.com/repos/afeena/tanner/comments{/number}","issue_comment_url":"https://api.github.com/repos/afeena/tanner/issues/comments{/number}","contents_url":"https://api.github.com/repos/afeena/tanner/contents/{+path}","compare_url":"https://api.github.com/repos/afeena/tanner/compare/{base}...{head}","merges_url":"https://api.github.com/repos/afeena/tanner/merges","archive_url":"https://api.github.com/repos/afeena/tanner/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/afeena/tanner/downloads","issues_url":"https://api.github.com/repos/afeena/tanner/issues{/number}","pulls_url":"https://api.github.com/repos/afeena/tanner/pulls{/number}","milestones_url":"https://api.github.com/repos/afeena/tanner/milestones{/number}","notifications_url":"https://api.github.com/repos/afeena/tanner/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/afeena/tanner/labels{/name}","releases_url":"https://api.github.com/repos/afeena/tanner/releases{/id}","deployments_url":"https://api.github.com/repos/afeena/tanner/deployments","created_at":"2016-04-24T14:14:01Z","updated_at":"2016-04-24T14:14:01Z","pushed_at":"2016-06-17T18:32:30Z","git_url":"git://github.com/afeena/tanner.git","ssh_url":"git@github.com:afeena/tanner.git","clone_url":"https://github.com/afeena/tanner.git","svn_url":"https://github.com/afeena/tanner","homepage":null,"size":96,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"mushorg:master","ref":"master","sha":"1399b18753fd9ac764745128560cf959c6aac1ba","user":{"login":"mushorg","id":2742625,"avatar_url":"https://avatars.githubusercontent.com/u/2742625?v=3","gravatar_id":"","url":"https://api.github.com/users/mushorg","html_url":"https://github.com/mushorg","followers_url":"https://api.github.com/users/mushorg/followers","following_url":"https://api.github.com/users/mushorg/following{/other_user}","gists_url":"https://api.github.com/users/mushorg/gists{/gist_id}","starred_url":"https://api.github.com/users/mushorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mushorg/subscriptions","organizations_url":"https://api.github.com/users/mushorg/orgs","repos_url":"https://api.github.com/users/mushorg/repos","events_url":"https://api.github.com/users/mushorg/events{/privacy}","received_events_url":"https://api.github.com/users/mushorg/received_events","type":"Organization","site_admin":false},"repo":{"id":40407153,"name":"tanner","full_name":"mushorg/tanner","owner":{"login":"mushorg","id":2742625,"avatar_url":"https://avatars.githubusercontent.com/u/2742625?v=3","gravatar_id":"","url":"https://api.github.com/users/mushorg","html_url":"https://github.com/mushorg","followers_url":"https://api.github.com/users/mushorg/followers","following_url":"https://api.github.com/users/mushorg/following{/other_user}","gists_url":"https://api.github.com/users/mushorg/gists{/gist_id}","starred_url":"https://api.github.com/users/mushorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mushorg/subscriptions","organizations_url":"https://api.github.com/users/mushorg/orgs","repos_url":"https://api.github.com/users/mushorg/repos","events_url":"https://api.github.com/users/mushorg/events{/privacy}","received_events_url":"https://api.github.com/users/mushorg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mushorg/tanner","description":"He who flays the hide","fork":false,"url":"https://api.github.com/repos/mushorg/tanner","forks_url":"https://api.github.com/repos/mushorg/tanner/forks","keys_url":"https://api.github.com/repos/mushorg/tanner/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mushorg/tanner/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mushorg/tanner/teams","hooks_url":"https://api.github.com/repos/mushorg/tanner/hooks","issue_events_url":"https://api.github.com/repos/mushorg/tanner/issues/events{/number}","events_url":"https://api.github.com/repos/mushorg/tanner/events","assignees_url":"https://api.github.com/repos/mushorg/tanner/assignees{/user}","branches_url":"https://api.github.com/repos/mushorg/tanner/branches{/branch}","tags_url":"https://api.github.com/repos/mushorg/tanner/tags","blobs_url":"https://api.github.com/repos/mushorg/tanner/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mushorg/tanner/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mushorg/tanner/git/refs{/sha}","trees_url":"https://api.github.com/repos/mushorg/tanner/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mushorg/tanner/statuses/{sha}","languages_url":"https://api.github.com/repos/mushorg/tanner/languages","stargazers_url":"https://api.github.com/repos/mushorg/tanner/stargazers","contributors_url":"https://api.github.com/repos/mushorg/tanner/contributors","subscribers_url":"https://api.github.com/repos/mushorg/tanner/subscribers","subscription_url":"https://api.github.com/repos/mushorg/tanner/subscription","commits_url":"https://api.github.com/repos/mushorg/tanner/commits{/sha}","git_commits_url":"https://api.github.com/repos/mushorg/tanner/git/commits{/sha}","comments_url":"https://api.github.com/repos/mushorg/tanner/comments{/number}","issue_comment_url":"https://api.github.com/repos/mushorg/tanner/issues/comments{/number}","contents_url":"https://api.github.com/repos/mushorg/tanner/contents/{+path}","compare_url":"https://api.github.com/repos/mushorg/tanner/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mushorg/tanner/merges","archive_url":"https://api.github.com/repos/mushorg/tanner/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mushorg/tanner/downloads","issues_url":"https://api.github.com/repos/mushorg/tanner/issues{/number}","pulls_url":"https://api.github.com/repos/mushorg/tanner/pulls{/number}","milestones_url":"https://api.github.com/repos/mushorg/tanner/milestones{/number}","notifications_url":"https://api.github.com/repos/mushorg/tanner/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mushorg/tanner/labels{/name}","releases_url":"https://api.github.com/repos/mushorg/tanner/releases{/id}","deployments_url":"https://api.github.com/repos/mushorg/tanner/deployments","created_at":"2015-08-08T15:28:24Z","updated_at":"2016-05-09T20:12:54Z","pushed_at":"2016-06-17T18:32:31Z","git_url":"git://github.com/mushorg/tanner.git","ssh_url":"git@github.com:mushorg/tanner.git","clone_url":"https://github.com/mushorg/tanner.git","svn_url":"https://github.com/mushorg/tanner","homepage":null,"size":94,"stargazers_count":9,"watchers_count":9,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":13,"forks":3,"open_issues":13,"watchers":9,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/41"},"html":{"href":"https://github.com/mushorg/tanner/pull/41"},"issue":{"href":"https://api.github.com/repos/mushorg/tanner/issues/41"},"comments":{"href":"https://api.github.com/repos/mushorg/tanner/issues/41/comments"},"review_comments":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/41/comments"},"review_comment":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mushorg/tanner/pulls/41/commits"},"statuses":{"href":"https://api.github.com/repos/mushorg/tanner/statuses/5b7b2b2b459a9a38405b77c2601b805025114c0a"}}}}
{"actor":{"display_login":"glaslos"}}