Posted: May 8th, 2010 | Author: xanda | Filed under: IT Related | Tags: 0day, jsunpack, rule, safari, window.parent.close(), yara | 1 Comment »
rule SafariWindowParentClose
{
meta:
ref = "Safari window.parent.close()"
impact = 7
strings:
$SafariWindowParentClose_1 = /.*?.prompt\(alert\)/
$SafariWindowParentClose_2 = /.*?.prompt\(.*?\)/
$SafariWindowParentClose_3 = /.*?.close\(\)/
condition:
all of them
} |
rule SafariWindowParentClose
{
meta:
ref = "Safari window.parent.close()"
impact = 7
strings:
$SafariWindowParentClose_1 = /.*?.prompt\(alert\)/
$SafariWindowParentClose_2 = /.*?.prompt\(.*?\)/
$SafariWindowParentClose_3 = /.*?.close\(\)/
condition:
all of them
}
[…] This post was mentioned on Twitter by alex knorr, Joxean Koret, Joxean Koret, Rubén Santamarta, Matthew de Carteret and others. Matthew de Carteret said: RT @xanda: Yara (and JSUNPACK) Rule for Safari window.parent.close() http://goo.gl/hYIu < nice! new 0day coming? 😛 […]