Hi I'm new to the world of proxo filters, and have been trying to understand how some of the filters that comes with the default cfg works. For some of the header filters, they don't have a "match" field (or they have * as the field value). e.g:
In = FALSE
Out = FALSE
Key = "Cookie: Fake a cookie (out)"
Match = "*"
Replace = "monster"
and
In = FALSE
Out = FALSE
Key = "Connection: Close all connections (In+Out)"
Replace = "close"
I can't for the life of me see how they work... as far as I can see, they should replace the whole header with "monster" (or "close"). Can anyone explain this to me?
Quote: they should replace the whole header with "monster" (or "close").
You are correct about the first example. The Match implies that there is something there in the first place, whereas in the second example it does not need to be. If there is no Match included, just a replace, then that field in the header will be created if it does not exist. This would happen only in the second example.
Siamesecat I think I phrased the question wrong. Let me try again:
Taking the 1st filter as an example, how does Proxo know where the Cookie bit of the header is?
A random header:
GET
http://www.paypal.com/en_US/i/btn/x-click-but04.gif HTTP/1.1
Accept: */*
Referer:
http://www.paypal.com/en_US/i/btn/x-click-but04.gif
Accept-Language: en-il
Accept-Encoding: gzip, deflate
If-Modified-Since: Wed, 30 Jul 2003 05:52:35 GMT
If-None-Match: "10009d-359-3f275d23"
User-Agent: Mozilla/1.22 (Windows; I; 16bit) via HTTP/1.0 shawcable-ca.net/
Host:
http://www.paypal.com
Cookie: Apache=81.103.147.215.211381087167355790
Connection: keep-alive
In order to replace the Cookie with a fake one, doesn't it need to search for the phrase "Cookie: *" or something?
(btw thanks Siamesecat I think I know how the second filter works now.
)
If you mean that the word "Cookie" would be replaced, no, that doesn't happen. The word or phrase in front of the colon in one line of the header is like a label on a pigeon-hole. You can remove or change the content of the pigeon-hole, but that will not affect the label.
Ok that's cool... but my question really is, say Proxo goes through the header line by line, how does it know when the label "Cookie:" has been reached and it should replace the content of the pigeon-hole with "monster"? In the filter itself it doesn't have anything that tells it this...
lol I'm learning something from you everyday....
The filter itself has a name: "Cookie:". I imagine that all it has to do is compare its name (the characters up to and including the colon but nothing after it) with the names of the fields in the header.
Oh yeah, thanks Siamesecat... that was simple. doh!
(I thought you can call your header filters any name, but now I notice they all start with the "label:", makes sense now.
)