> ****************************************************************************************** > Test two : i just add a spoofed http header REFERER to a whitelisted > (localdatabase) site > Result : W00t !! > ******************************************************************************************
Can you elaborate on, "to a whitelisted (localdatabase) site"? None of the rules defined in the Web Authentication Layer or Web Access Layer have a "whitelist" attribute. In the list of available actions for the Web Authentication Layer there's: "Do Not Authenticate", "ForceAuthenticate1" and "Deny." In the Web Access Layer list of available actions there are a couple dozen options, none of which are labeled "whitelist" or "whitelisted." Also, I'm not sure what you mean by "localdatabase". Internal http traffic shouldn't hit the proxies... Using an 8100-C with SG05 5.2.4.3. -Guy _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
