bf8b467a3e
The tool generate two lists, one for IPv4 (list4.json) and one for IPv6 (list6.json) to allow the user to only enable one of the two. The list is downloaded from http://public-dns.info/ and a sample of the list was tested with: for dns in $( awk -F "," '{ print $1 }' < nameservers.csv ) ; do dig +noedns @$dns google.com | grep NOERROR 1>/dev/null || echo $dns ; done ~95% of the tested servers responded. So the list is not all crap. |
||
|---|---|---|
| lists | ||
| tools | ||
| .travis.yml | ||
| README.md | ||
README.md
misp-warninglist
misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.
The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators are available in one of the list. The list can be globally enabled or disabled in MISP following the practices of the organization.
lists
- lists/alexa - Top 1000 websites from Alexa
- lists/empty-hashes - hash values of empty files
- lists/google - known domains and hostnames from Google
- lists/multicast - known IPv4 multicast CIDR blocks
- lists/public-dns - IP addresses of public DNS resolver
- lists/rfc1918 - RFC 1918 network subnets
- lists/rfc3849 - RFC 3849 - Documentation prefix for ipv6
- lists/rfc5735 - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
- lists/second-level-tlds - Mozilla list of second level top-level domains
- lists/tlds - top-level domains
Format of a warning list
{
"name": "List of known public DNS resolvers",
"version": 1,
"description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
"matching_attributes": [
"ip-src",
"ip-dst"
],
"list": [
"8.8.8.8",
"8.8.4.4",
"208.67.222.222",
"208.67.220.220",
"195.46.39.39",
"195.46.39.40"
]
}
If matching_attributes are not set, the list is matched against any type of attributes.