Bro signature for detecting iframes

Howdy all,

Is there any way for Bro to detect/view/parse/whatevs the HTML and/or JS from a visited webpage? If I need to script something out, I don’t mind. My Google-fu has failed to direct me towards any resource that would be a good starting point.

Any help would be much appreciated, thanks!

Bro can reassemble and extract the HTML or Javascript file but does not have the ability to parse, render, or emulate them.

-AK

Cool. Doing that for every site just to run a script against sounds like it would melt the box. Ah well, back to the drawing board.

Thanks!

Yeah, it’s one of the general problems with doing parsing of HTML, etc. is that it’s way too easy to melt the box. :slight_smile: Some of it can be done but it needs to be done in very particular ways. You generally don’t get the opportunity to just blindly load an entire HTML document into memory and parse it into a DOM (unfortunately, because that would be awesome if it was reasonable!).

There is some very early that has been done that lets you parse out various bits from files. For example, I have a script that uses that functionality to parse titles out of webpages and add it to the http log. It does need some more work though, there are some functionality and behavior issues that need corrected.

  .Seth