Remove Obfuscated Code [20081221b]

[DarthTrader]

(Dec. 21, 2008 03:28 AM)Kye-U Wrote:  Thanks for the additional testbed! I'm working on having a filter general enough to match both (and the IE PoC) while having minimal false positives.

EDIT: Updated. I decided to implement lnminente's "open script/closed script" variable, and also decided to not kill the rest of the page, but remove as much obfuscated code as possible (limited to 32767 bytes) and allow the page to still load.

If you're already using your own "open script/closed script" filter, feel free to modify this filter.

Thanks, KyeU. Your new filter seems to be working fine, although the coding is a bit over my head now. Here's what I came up with last night:

Code:

[Patterns]
Name = "<script>: Remove Obfuscated Code [20081220b dt]"
Active = TRUE
URL = "($TYPE(htm)|$TYPE(js)|$TYPE(vbs))"
Bounds = "$NEST(<script,</script*>)"
Limit = 32767
Match = "*(\\([0-7]+{1,3}&&[#000:377])"
        "|(%|\\x)([a-f0-9])+{2}"
        "|(%|\\)u([a-f0-9])+{4}"
        ")+{5,*}*"
Replace = "$ALERT(Script with obfuscated code surgically removed from:\r\n\r\n\u\r\n\r\n)"