On 8 Nov 2018, at 21:55, John Hardin wrote:
On Thu, 8 Nov 2018, Amir Caspi wrote:
On Nov 8, 2018, at 7:41 PM, John Hardin <jhar...@impsec.org> wrote:
Sure, but I't also prefer to have a sample to test on before
committing. I'll see if I can get the pastebin to work (i.e. fix the
boundary)
I can send you some new spamples via attachment, privately.
No, the pastebinned ones work unaltered.
The problem with that: they are mangled in a way that prevents HTML
interpretation of then HTML part. Hence a 'body' rule will match the
uninterpreted entities. For the real world, i.e. with proper MIME
structure, I think you need a 'rawbody' rule to match against the
uninterpreted entities.
I have confirmed that de-munging the boundaries fixes them to allow
proper MIME interpretation. In both cases, the boundary line between the
2 MIME parts is apparently unchan ged, so you can just use it to fix the
other 3 places that it needs to match.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Available For Hire: https://linkedin.com/in/billcole
