On Mon, 27 Jul 2009, Mike Wallace wrote:
John, the current version doesn't trap that type of URI and that's why I
am using the older version and mentioned it.
That's odd, because I added that sample line to my testbed and it did hit:
[31850] dbg: rules: ran body rule URI_OBFU_WWW ======> got hit: "www.onlyviagra
net"
I have collected 13 examples of obfuscated URIs that I can send you.
Please send them - thanks.
Also, I just committed a minor update, you might want to grab the rule
from svn again.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
An entitlement beneficiary is a person or special interest group
who didn't earn your money, but demands the right to take your
money because they *want* it. -- John McKay, _The Welfare State:
No Mercy for the Middle Class_
-----------------------------------------------------------------------
9 days until the 274th anniversary of John Peter Zenger's acquittal
