Quoting Karsten Bräckelmann <[EMAIL PROTECTED]>:
>
> describe SILLYDOTSDOMAINURI Includes a multiple dots domain name
> body SILLYDOTSDOMAINURI /^http?\:\/\/([a-z0-9_\-A-Z]+\.)+\./
Have you ever seen these? Would it work, does any MUA or browser
silently collapse multiple dots?
I saw one of these in a phishing email. I didn't know if it was
supposed to be that way or not, but I was quite curious. Firefox
tries to connect to http://www..google.com . (click it and see)
Firefox will also try to connect to http://www.*.google.com . On the
blackhole DNS discussion boards, there were users reporting seeing
wildcard (*) DNS entries in phishing emails. Additionally, Yahoo and
Flash both use wildcard DNS entries in their generated URLs. Is this
SA evasion?
So as I pondered it, it seemed plausible that a phisher could create a
zero-length subdomain which would evade scanning by regex processors
(like SA) because it would not parse out as a valid URL. But the
browser will still try to connect. Is this SA evasion? Seems quite
plausible.
Next up: a SA rule to detect "http://"; followed by an invalid URL!
jp
--
Framework? I don't need no steenking framework!
----------------------------------------------------------------
@fferent Security Labs: Isolate/Insulate/Innovate
http://www.afferentsecurity.com
