SA Bugzilla – Bug 4542
Suggestion for the replace_tags in 25_replace.cf.
Last modified: 2019-06-18 17:48:55 UTC
Looking at 3.1.0-rc1, the replace_tag for A doesn't include 4, a common "leet speak" substitute. Also for readability, I'd suggest moving all the non-hex values to the begining. replace_tag A [gra0o4\@\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xe4\xe3\xe2\xe0\xe1\xe2\x e3\xe4\xe5\xe6] Also, Are you really sure you want 0 and o here? (They're hidden on the end of the original, I moved them to the begining so they can be seen) S, T and Z are missing their common numeric "leet speak" substitutes 5,7,and 2: replace_tag S [sz5\xa6\xa7] replace_tag T [t7] replace_tag Z [zs2] Y has a burried j at the end: replace_tag Y [yj\xff\xfd\xa5] Lastly, you might want to consider using the [\W_]{0,3) for W3, much like I use in antidrug. V_I_A_G_R_A is still a very common obfu and _ is considered a word charachter and won't match \W.
I'd also like to suggest adding & for A and / for I.
Closing ancient bugs. Tags evolved quite a bit during this time..