ABE on nnm-club.me

Discussions about the Application Boundaries Enforcer (ABE) module
JonIrenicus
Posts: 12
Joined: Sun Nov 10, 2013 8:42 am

ABE on nnm-club.me

Post by JonIrenicus »

ABE blocks all links on this site.
The rule is not working:

Code: Select all

# User-defined rules. Feel free to experiment here.
Site nnm-club.me
Accept from SELF
Accept from nnm-club.me
Deny INCLUSION
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
barbaz
Senior Member
Posts: 10847
Joined: Sat Aug 03, 2013 5:45 pm

Re: ABE on nnm-club.me

Post by barbaz »

I'm having trouble even accessing that site. I got there once, and it worked, but I can't seem to get there again.
(Ah, you can't click that link, you have to copy&paste it. Wonder why they would drop requests where referer is informaction?)

Do you see any ABE-related messages in the Browser Console (Ctrl-Shift-J) ? If so please post them here

In any case, you might want to change that rule to

Code: Select all

# User-defined rules. Feel free to experiment here.
Site .nnm-club.me .nnm-club.ws
Accept from .nnm-club.me .nnm-club.ws
Deny INCLUSION
(What is the threat you are trying to stop there?)
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: ABE on nnm-club.me

Post by Thrawn »

barbaz wrote: (Ah, you can't click that link, you have to copy&paste it. Wonder why they would drop requests where referer is informaction?)
Probably a primitive CSRF defence, where they block unrecognised referrers, but allow blank ones.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
JonIrenicus
Posts: 12
Joined: Sun Nov 10, 2013 8:42 am

Re: ABE on nnm-club.me

Post by JonIrenicus »

barbaz wrote:(What is the threat you are trying to stop there?)
I don't know why, but if I open this link on FIRST time, I've got Message string from ABE, something like "Request GET http://nnm-club.me/forum/viewforum.php?f=225 ... filtered by ABE <LOCAL> Deny".
Now I open this link and there is NO ANY error...
Here the screenshot:
Image
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
barbaz
Senior Member
Posts: 10847
Joined: Sat Aug 03, 2013 5:45 pm

Re: ABE on nnm-club.me

Post by barbaz »

Oh... that's a rather different beast. Please post the message(s) from ABE that you see in the Browser Console (Ctrl-Shift-J) when this happens, also do a reverse DNS lookup on nnm-club.me (use nslookup in a command prompt) and please post that too.

Possible workaround (but the above information is needed to determine whether this is safe):
add to the very top of the SYSTEM ruleset

Code: Select all

Site nnm-club.me
Accept from nnm-club.me
*Always* check the changelogs BEFORE updating that important software!
-
Post Reply