IE Spoofed Link Filter

Kye-U · Sergeant Joined: Oct 18, 2003 Posts: 147

Version 3 is a filter based on the exploit examples on http://www.zapthedingbat.com/security/ex01/vun1.htm and http://www.secunia.com/internet_explore...fing_test/

[Patterns]
Name = "Fix: Spoofed Address v3 [Kye-U]"
Active = TRUE
URL = "$TYPE(htm)|$TYPE(js)"
Bounds = "$NEST(<a\s,>)|$NEST(<input\s,>)|$NEST(<button\s,>)|$NEST(<script\s,>)|$NEST(<*onclick=\s,>)|$NEST(<*onmousedown=\s,>)|$NEST(<*href=\s,>)"
Limit = 512
Match = "\0://\1[^/]++(|;)@\2"
Replace = "\0://\2"

OR [ProxFox's Edition] with the Alert message:

[Patterns]
Name = "Fix: Spoofed Address v3 [Kye-U]"
Active = TRUE
URL = "$TYPE(htm)|$TYPE(js)"
Bounds = "$NEST(<a\s,>)|$NEST(<input\s,>)|$NEST(<button\s,>)|$NEST(<script\s,>)|$NEST(<*onclick=\s,>)|$NEST(<*onmousedown=\s,>)|$NEST(<*href=\s,>)"
Limit = 512
Match = "\0://\1[^/]++(|;)@\2"
Replace = "\0://\2"
"$ALERT(Fixed Spoofed Address - '\2' removed from \0://\1)"

Onlooker · Guest

I have a little problem with the syntax "(|;)". According to the Prox help file, if one matches something or nothing, the something must come first, otherwise it will never be matched, since nothing can always match. Shouldn't the syntax be "(;|)"?

kbirger · Trooper Joined: Jan 16, 2004 Posts: 18 Location: USA

um, it still doesnt fix the exploit on the first site...

Kye-U · Sergeant Joined: Oct 18, 2003 Posts: 147

This is an older version. The latest and probably final version is v5.

kbirger · Trooper Joined: Jan 16, 2004 Posts: 18 Location: USA

forgive me if this is stupid, but where can i find v 5?=)

Kye-U · Sergeant Joined: Oct 18, 2003 Posts: 147

http://www.computercops.biz/postt10365.html


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1341 pages served in previous 5 minutes. Page Rendered: 0.333 seconds.