CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

"TE: Kill" header filter

 
Post new topic   Reply to topic       All -> FavForums -> Sidki - Proxomitron [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
42unite

Corporal
Corporal


Joined: May 09, 2004
Posts: 57
Location: USA

PostPosted: Sun May 18, 2008 1:43 am    Post subject: "TE: Kill" header filter
Reply with quote

Was looking through the config and saw this header filter in Sidki's newest 2008-01-02:

In = FALSE
Out = TRUE
Key = "TE: Kill 6.09.29 [sd] (d.0) (Out)"


The above three lines are all that's there.

I then looked back through old config versions and, in one that I'd dated 15 Oct 06 (and many previous versions), found this filter:

In = FALSE
Out = TRUE
Key = "TE: Kill while faking User-Agent 5.09.07 [sd] (d.0) (Out)"
URL = "$TST(keyword=*.f_ua_*)"


So somewhere in mid to late Oct 2006 the filter was modified.
Is the latest first version correct and functional?

Back to top
View users profile Send private message
ProxFox

Proxomitron Host
Proxomitron Host


Joined: Nov 11, 2003
Posts: 940
Location: USA

PostPosted: Sun May 18, 2008 3:29 pm    Post subject:
Reply with quote

the three lines is correct and functional - simply axes the TE: header filter on all URL's...

and axes it whether or not it "contains" anything or not...
whereas "pragma" and "set-cookie" (directly above "te") axes only if "empty", but again does so on all URL's (no URL line in the filter)...

now, correct and funtional, yes... but "intentional" by sidki, not sure...


ps - good header filter resource: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

Back to top
View users profile Send private message
42unite

Corporal
Corporal


Joined: May 09, 2004
Posts: 57
Location: USA

PostPosted: Sun May 18, 2008 6:04 pm    Post subject:
Reply with quote

Had looked-up TE header info @ http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html, and from that did not understand if Sidki's filter was 'complete' as is.

14.39 TE
The TE request-header field indicates what extension transfer-codings it is willing to accept in the response and whether or not it is willing to accept trailer fields in a chunked transfer-coding. Its value may consist of the keyword "trailers" and/or a comma-separated list of extension transfer-coding names with optional accept parameters...


My concern was the 'missing entry' URL = "$TST(keyword=*.f_ua_*)".

Since Sidki modified this filter a long time ago, and most probably would have caught such an error by now question, I'll assume it to be accurate and leave it as is! Smile

Just wanted to run it by the readers here.

Thank you ProxFox.

Back to top
View users profile Send private message
ProxFox

Proxomitron Host
Proxomitron Host


Joined: Nov 11, 2003
Posts: 940
Location: USA

PostPosted: Sun May 18, 2008 6:23 pm    Post subject:
Reply with quote

have you found any sites that use "TE" in the header?

Back to top
View users profile Send private message
whenever

Lieutenant
Lieutenant


Joined: May 18, 2007
Posts: 163
Location: China

PostPosted: Mon May 19, 2008 2:37 am    Post subject:
Reply with quote

ProxFox wrote:
the three lines is correct and functional - simply axes the TE: header filter on all URL's...

and axes it whether or not it "contains" anything or not...

According to the help file:
Quote:

To delete a header: include a matching expression, but leave the replacement text blank.

Shouldn't we use a "*" in the matching field?

Back to top
View users profile Send private message
ProxFox

Proxomitron Host
Proxomitron Host


Joined: Nov 11, 2003
Posts: 940
Location: USA

PostPosted: Mon May 19, 2008 12:01 pm    Post subject:
Reply with quote

good point...
but even the "original" filter in question didn't have a "match" line, so i guess i'm stumped...

is anyone finding any sites that even USE "TE:" ?

Back to top
View users profile Send private message
ecli

Trooper
Trooper


Joined: Dec 27, 2005
Posts: 17
Location: USA

PostPosted: Sun Sep 07, 2008 11:19 pm    Post subject:
Reply with quote

ProxFox wrote:
but even the "original" filter in question didn't have a "match" line


I'm confused too (I guess it's some UNDOCUMENTED feature!)

ProxFox wrote:

is anyone finding any sites that even USE "TE:" ?


I believe "TE:" is a REQUEST header, Opera uses it:

Code:
TE: deflate, gzip, chunked, identity, trailers

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Sidki - Proxomitron All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer