Xanda's Blog !~!

rule SafariWindowParentClose
{
   meta:
      ref = "Safari window.parent.close()"
      impact = 7
   strings:
      $SafariWindowParentClose_1 = /.*?.prompt\(alert\)/
      $SafariWindowParentClose_2 = /.*?.prompt\(.*?\)/
      $SafariWindowParentClose_3 = /.*?.close\(\)/
   condition:
      all of them
}

rule SafariWindowParentClose { meta: ref = "Safari window.parent.close()" impact = 7 strings: $SafariWindowParentClose_1 = /.*?.prompt\(alert\)/ $SafariWindowParentClose_2 = /.*?.prompt\(.*?\)/ $SafariWindowParentClose_3 = /.*?.close\(\)/ condition: all of them }