> i think it basically means 'to a site thats been configured as allowed in the > configuration of the BC' - allowed = whitelisted, int he configuration = > localdatabase > > alan
Alan, The Bluecoat 8100-C I'm going through has 27 policies in the "Web Access Layer." The first policy is configured to "ForceContentFail" for a list of destinations (a "blacklist" since colors seem to be in). The next 15 (2-16) policies are all DENY rules for specific hosts, IPs, regex patters, filenames, etc. The next 10 rules (17-26) are for destinations that should Bypass Caching. The final rule (27) is, Source: Any - Destination: Any - Service/Time: Any, Action: Allow. Google.com isn't listed anywhere in the first 26 policies - anyone on the LAN can access Google without authenticating. So, if I understand what you're saying, I should be able to spoof the "Referer" string sent from my browser to something like www.google.com, or cnn.com, whatever isn't listed in any of the DENY policies, and not only bypass authentication, but access sites explicitly defined in the deny policies? If that's the case, circumventing the auth or accessing "blacklisted" sites isn't happening. This is good of course; the device is working as it's supposed to, but I would like to confirm whether or not we're susceptible to this alleged bypass. So far, looks like a dud... Not even sure why this would work, it seems too simple. -Guy _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
