Re: http://isc.sans.org/diary.php?storyid=1342
(1) Are there any rules currently in SA or SARE that will trigger on encoded characters in the hostname part of a URL? (2) Does the URL extractor for SURBL checks properly deal with URL-encoded hostnames? -- John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- The problem is when people look at Yahoo, slashdot, or groklaw and jump from obvious and correct observations like "Oh my God, this place is teeming with utter morons" to incorrect conclusions like "there's nothing of value here". -- Al Petrofsky, in Y! SCOX -----------------------------------------------------------------------
