PDA

View Full Version : Kye-U filter

Mrkvonic
June 26th, 2005, 08:03 AM
Hi,
I browsed the forum and found only update to version 4.31.
However, I'm using 4.33 already. Since the Kye-U site went down some weeks ago, I am unable to locate any update to the filter (if there's such one). Does anyone know where the most update cgf download is available (on hopto?)?
Kye-U's answer would be most appreciated.
Mrk

P.S. I LOVE your filters. They killed both recently discovered firefox vulnerabilities. Jolly good job, man!
Kye-U
June 26th, 2005, 11:47 AM
Hi Mrkvonic,

If my server keeps acting like this I just gotta find a new one :)

I've attached the latest one here (v4.34). School just ended for me so now I have LOTS of time to work on my cfg :)

Thank you for that little message =) For the latest one here:

http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/

My latest config changes the <Body OnUnLoad> to <Body UnLoadOff> to prevent the script from running when you click on the link, and it also kills the two javascript functions screen.width and screen.height, possibly messing with the location of the spoofed message box on your screen ^_^

The good news (for me) is that I just need to make a few updates for my KBSP every now and then, since most exploits are spoofing ones (involving some javascript, <Body Onload> or <Body OnUnLoad>). It's just the Denial of Service exploits I need to worry about :)
iceni60
June 26th, 2005, 12:56 PM
thanks Kye-U, i was trying to find the download yesterday, but the site must have been down.
Mrkvonic
June 27th, 2005, 02:09 AM
Hi,
Thanks a lot mate!
Just a few side questions: do I keep the configuration set to your default, or should I add more options? For instance, in the very top of web, there's the line securty pack 4.33 (or 4.34). Are these just titles or headers or real options that should be also ticked? Do you recommend other filters, like jd or such?
Anyhow...
Superb work! Keep it up!
Mrk
Kye-U
June 27th, 2005, 11:17 AM
-{ Quote: "Hi,
Thanks a lot mate!
Just a few side questions: do I keep the configuration set to your default, or should I add more options? For instance, in the very top of web, there's the line securty pack 4.33 (or 4.34). Are these just titles or headers or real options that should be also ticked? Do you recommend other filters, like jd or such?
Anyhow...
Superb work! Keep it up!
Mrk" }-

Oh, that is a header, just ignore that :) (don't tick it)

Just keep it default, and if you experience a filter that is matching everything (false positives) just email me with the name of the filter and the URL of the site where it's matching (my email address is in the readme). I'm saying to email me because my site is currently down. Normally I would ask you to post in my forums ;)

I recommend Sidki's configuration pack as JD5000 has not updated his in quite a while. Also, Grypen is doing a wonderful job at keeping JD5000's up to date :)

Thanks again ;)