Re: [Assp-user] Obfuscated URIs

2007-01-28 Thread Fritz Borgstedt
Hmm, it works for me. If somebody could (dis)confirm: It is catched by Bayesian )))(((. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your

Re: [Assp-user] Obfuscated URIs

2007-01-28 Thread Przemek Czerkas
Hmm, it works for me. If somebody could (dis)confirm: It is catched by Bayesian )))(((. OK, my previous patch lied a little ;-) change: if ($uri=~/(?:[^\s\/[EMAIL PROTECTED]@)?([0-9a-z\-\_\.]+)/i) { to: if ($uri=~/(?:[^\s\/[EMAIL PROTECTED]@)?($URICharRe+)/i) { P.

Re: [Assp-user] Obfuscated URIs

2007-01-28 Thread Fritz Borgstedt
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: shold be: if ($uri=~/(?:[^\s\/[EMAIL PROTECTED]@)?($URICharRe+)/io) { success: Jan-28-07 14:39:39 193.99.144.71 [EMAIL PROTECTED] to: [EMAIL PROTECTED] failed URIBL checks (obfuscated uri)

Re: [Assp-user] Obfuscated URIs

2007-01-28 Thread Nick Kelly
by Fritz Borgstedt Jan 29, 2007; 12:46am :: Rate this Message shold be: if ($uri=~/(?:[^\s\/[EMAIL PROTECTED]@)?($URICharRe+)/io) { success: Jan-28-07 14:39:39 193.99.144.71 [EMAIL PROTECTED] to: [EMAIL PROTECTED] failed URIBL checks (obfuscated uri) heisec_Emailcheck_Links_eejmzbo_ -

Re: [Assp-user] Obfuscated URIs

2007-01-23 Thread Nick Kelly
From: William Stucke [EMAIL PROTECTED] When enabled, messages with obfuscated URIs of types [integer/octal/hex IP, other things!] in the body will receive URIBLPolicyError SMTP error code. Fair call, but I was rather more interested in the list of what the 'other things!' might be. ;-)

Re: [Assp-user] Obfuscated URIs

2007-01-23 Thread Fritz Borgstedt
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Fair call, but I was rather more interested in the list of what the 'other things!' might be. You are surely joking but... it is Open Source, you can read it. fritz

Re: [Assp-user] Obfuscated URIs

2007-01-23 Thread Przemek Czerkas
Maybe it doesn't work at all (including up to 1.2.7.1 (68). I have never actually had a hit on this function, but I may just have been lucky. The check in its current form secures against http://www.pc-help.org/obscure.htm types of obfuscation. Some of the examples in this test are just

[Assp-user] Obfuscated URIs

2007-01-22 Thread Nick Kelly
Regarding Disallow Obfuscated URIs I have noticed that this function does not block all types of obfuscated URIs. While my perl is not quite good enough to get right to the bottom of it, may I suggest that the description text outline briefly what types the check does cover. Eg currently,

Re: [Assp-user] Obfuscated URIs

2007-01-22 Thread Przemek Czerkas
Regarding Disallow Obfuscated URIs I have noticed that this function does not block all types of obfuscated URIs. Please post a real-world example of such URIs. While my perl is not quite good enough to get right to the bottom of it, may I suggest that the description text outline briefly