# Learning the Bro Scripting Language Part 3 - Detecting basic auth and going from evidence to practical use in Bro **URL:** \ **Category:** Zeek\ **Created:** [May 4, 2012, 3:24pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308 "2012-05-04T15:24:04Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Scott\_Runnels](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Scott\_Runnels](https://community.zeek.org/u/Scott_Runnels)\ **Post date:** [May 4, 2012, 3:24pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/1 "2012-05-04T15:24:04Z")
I sent the first post of the series to the mailing list and got a decent response from people who were interested in learning Bro’s scripting language. This post tries to move to a more operationally useful script and something you could actually deploy across an enterprise. If anyone has any comments or critiques I’d love to hear them. [http://ryesecurity.blogspot.com/2012/05/learning-bro-scripting-language.html](http://ryesecurity.blogspot.com/2012/05/learning-bro-scripting-language.html) v/r Scott Runnels ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [May 4, 2012, 4:34pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/2 "2012-05-04T16:34:48Z")
Great post! Perfect cheat-sheet for incident responders that need to add something specific. ---
**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\ **Post date:** [May 4, 2012, 7:09pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/3 "2012-05-04T19:09:57Z")
> I sent the first post of the series to the mailing list and got a > decent response from people who were interested in learning Bro's > scripting language. Nice work, Scott! One small comment: "Three lines of Bro's scripting language and we can detect a server using Basic Access Authentication!" It's actually just one line [1]:     redef HTTP::default\_capture\_password = T; This automatically creates a new column password in the http.log with the password value, if available. Keep the posts coming!     Matthias [1] [http://git.bro-ids.org/bro.git/blob/HEAD:/scripts/base/protocols/http/main.bro#l233](http://git.bro-ids.org/bro.git/blob/HEAD:/scripts/base/protocols/http/main.bro#l233) ---
**Author:** ![Scott\_Runnels](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Scott\_Runnels](https://community.zeek.org/u/Scott_Runnels)\ **Post date:** [May 4, 2012, 7:24pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/4 "2012-05-04T19:24:59Z")
Hi Mattias, Thank you! Yea, that's definitely a little misleading on my part. I tried to touch on the fact that "Hey, Bro really does this kind of stuff under the hood!" I actually saw the username getting parsed out when I was dumping the connection getting passed into http\_header and sent some colorful language at Seth over IM 🙂 I'm hoping to try to get as many posts up as I can think of. I've been working pretty closely with Seth to make sure that I don't do something 'unbroly', that I stick to the already established conventions, and to make sure I don't go about spreading any misinformation. It's been a great learning experience. I'll reiterate what I said the post, "Some day, I'll stop being shocked by everything Bro does and just accept that it's wall-to-wall awesome!" Kind of hard sometimes, though! v/r Scott Runnels ---
**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\ **Post date:** [May 4, 2012, 7:39pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/5 "2012-05-04T19:39:50Z")
> I'm hoping to try to get as many posts up as I can think of. Terrific! > I've been working pretty closely with Seth to make sure that I don't > do something 'unbroly', that I stick to the already established > conventions, and to make sure I don't go about spreading any > misinformation. For sure, you're on the safe path with Seth on your side :-). Speaking of conventions, one additional Bro idiom comes to mind. Maybe that's already clear to you, even better then. As you may have noticed, there are several boolean indicator flags in the connection record. This introduces a new idiom: selectively enabling or disabling certain analyses on a \*per-connection basis\*. For example, you may only want to exclude logging passwords of users from a specific subnet. All that this requires is setting HTTP::capture\_password to true for connections that do not originate from the corresponding subnet (or if the reverse is easier, setting it to false for that specific subnet).     Matthias ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/learning-the-bro-scripting-language-part-3-detecting-basic-auth-and-going-from-evidence-to-practical-use-in-bro/2308/6 "2022-05-06T15:40:20Z")
Closed on May 6, 2022, 3:40pm UTC