Threaded Mode | Linear Mode

lnminente · (This post was last modified: Dec. 18, 2008 10:47 PM by lnminente.)

These following filters allows you to confirm when downloading executables. The autor is Kye-U.
I removed confirmation on .exe files. Firefox includes a confirm, if you want to add it, replace eml for eml|exe in both filters

Code:

[HTTP headers]

In = FALSE

Out = TRUE

Key = "!-URL-Killer: Catch Suspicious Extensions {Kye-U} (out) REMOVED EXE"

URL = "(^$LST(Trusted-Web))(^*=(^http://*.(^([a-z]+{2,4})(^/))))*.(hta|eml|hlp|jse|lnk|url|ba(s|t)|c(om|md)|vb(e|s|)|s(cr|hs)|p(if|cd)|a(d(e| p)|nr)|c(hm|pl|rt)|i(ns|sp)|m(d(b|e)|s(c|i|p|t))|ws(f|h|c))(^?)$LOG(R$DTM(c) URL-Killer, Catch suspicious extensions: BLOCK?)$CONFIRM(SUSPICIOUS FILE EXTENSION FOUND\n\nBlock connection to the URL below?\n\u)"

Replace = "\k"

In = TRUE

Out = FALSE

Key = "Content-Disposition: Catch Suspicious Extensions {Kye-U} (in) REMOVED EXE"

URL = "(^$LST(Trusted-Web))"

Match = "(*filename=$AV(\1.((hta|eml|hlp|jse|lnk|url|ba(s|t)|c(om|md)|vb(e|s|)|s(cr|hs)|p(if|cd)|a(d(e |p)|nr)|c(hm|pl|rt)|i(ns|sp)|m(d(b|e)|s(c|i|p|t))|ws(f|h|c))\2)))$LOG(R$DTM(c) Content-Disposition,Catch suspicious extensions: BLOCK?)$CONFIRM(SUSPICIOUS FILE EXTENSION FOUND\n\nBlock connection to the file below?\n\n\1.\2\n\nHost:\n\h\n\nPath:\n\p\n)"

Replace = "\k"

Kill favicons not arriving like images. Autor: {ln}, me.
It uses favicon.ico in html folder.

Code:

[HTTP headers]

In = TRUE

Out = FALSE

Key = "Content-Type: Kill non image FavIcons {ln}081213 (in)"

URL = "*\/favicon.ico"

Match = "(\2;*|\2)&(^ image/*)"

Replace = "$LOG(R$DTM(c): Killed non image FavIcon (\2) at \u) \k $JUMP(http://local.ptron/favicon.ico)"

Bypass web filtering in the webs you put in the list Trusted-Web

Code:

[HTTP headers]

In = FALSE

Out = TRUE

Key = "URL: Bypass web filters in Trusted webs (out)"

Match = "$LST(Trusted-Web)"

Replace = "$FILTER(False)$LOG(wBypass web filters in Trusted webs in /u)"

Rapid access to debugging. Autor: me.
These filters provides rapid acces to debug and to see source bypassed. It works pressing the selected keys while loading the page.
You can select the key you prefer with the command $KEYCHK, see the help of proxomitron and about_keys from the config of Sidki.

Code:

[HTTP headers]

In = FALSE

Out = TRUE

Key = "URL: Redirect to bypassed source on pressing F8 key {ln}081116 (out)"

URL = "$KEYCHK(^F8)"

Match = "*"

Replace = "$RDIR(http://\xsrc..bypass..\h\p\q\a)$LOG(!RBypassed source================)"

In = FALSE

Out = TRUE

Key = "URL: Redirect to debug on pressing F6 key {ln}081027 (out)"

URL = "$KEYCHK(^F6)"

Match = "*"

Replace = "$RDIR(http://\xdbug..\h\p\q\a)$LOG(!RDebug================)"

The purpose of this filter is to have a more informative log window

Code:

[HTTP headers]

In = TRUE

Out = FALSE

Key = "URL: Log requests for non images and highlight info sent in URL {ln}081213 (in)"

URL = "(^local.ptron*)"

Match = "(*(;*)\3|*)\1$IHDR(Content-Type:(\2;*|\2))(^$TST(\2= image*))"

Replace = "\1$LOG(W***OPEN $DTM(c) (\2)*** \h\p\q) ($SET(0=\q\a)$TST((\0)=*)$LOG(C    \0)|) ($TST((\3)=*)$LOG(C    \3)|)"

And I $STOP() and wait for more experts Wink