Hello Clayton,
Tuesday, May 3, 2005, 11:13:01 AM, you wrote:
CK> Jesse Houwing wrote:
>> Keith Ivey wrote:
>>> Jesse Houwing wrote:
>>>> BODY TABLEOBFU
>>>> m{<td([^>]+|"[^"]+)>(<([^>]+|"[^"]+)>)*[a-z]{1,2}(<([^>]+|"[^"]+)>)*</td([^>]+|"[^"]+)>}i
>>>
>>> m{<td([^>"]+|"[^"]*")*>(<([^>"]+|"[^"]*")*>)*[a-z]{1,2}(<([^>"]+|"[^"]*")*>)*</td([^>"]+|"[^"]*")*>}i
>>>
>> rawbody tblobfu_opttag
>> /<td(?:[^>'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}(?![oi][ns]|an?|en|of|de|l[ae]|us|no|tm)[a-z]{1,2}(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i
>> rawbody tblobfu_tag
>> /<td(?:[^>'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){1,5}(?![oi][ns]|an?|en|of|de|l[ae]|us|no|tm)[a-z]{1,2}(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){1,5}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i
>>
CK> Does any have any updated information regarding the effectiveness of
CK> these rules, or possibly any updated alternatives to put in place
CK> against messages involving the use of tables?
Nothing useful from here, but now that the first round of this
generation of OBFU rules from SARE are out, I've got some rules which
are worth testing, and will be mass-checking those tonight. Hopefully
I'll have something worth publishing within a week or two (sooner if
they exceed expectations).
Bob Menschel
