Page 1 of 1

ABE on nnm-club.me

Posted: Sun Jun 14, 2015 8:50 am
by JonIrenicus
ABE blocks all links on this site.
The rule is not working:

Code: Select all

# User-defined rules. Feel free to experiment here.
Site nnm-club.me
Accept from SELF
Accept from nnm-club.me
Deny INCLUSION

Re: ABE on nnm-club.me

Posted: Sun Jun 14, 2015 3:40 pm
by barbaz
I'm having trouble even accessing that site. I got there once, and it worked, but I can't seem to get there again.
(Ah, you can't click that link, you have to copy&paste it. Wonder why they would drop requests where referer is informaction?)

Do you see any ABE-related messages in the Browser Console (Ctrl-Shift-J) ? If so please post them here

In any case, you might want to change that rule to

Code: Select all

# User-defined rules. Feel free to experiment here.
Site .nnm-club.me .nnm-club.ws
Accept from .nnm-club.me .nnm-club.ws
Deny INCLUSION
(What is the threat you are trying to stop there?)

Re: ABE on nnm-club.me

Posted: Sun Jun 14, 2015 11:19 pm
by Thrawn
barbaz wrote: (Ah, you can't click that link, you have to copy&paste it. Wonder why they would drop requests where referer is informaction?)
Probably a primitive CSRF defence, where they block unrecognised referrers, but allow blank ones.

Re: ABE on nnm-club.me

Posted: Sat Jun 20, 2015 2:12 pm
by JonIrenicus
barbaz wrote:(What is the threat you are trying to stop there?)
I don't know why, but if I open this link on FIRST time, I've got Message string from ABE, something like "Request GET http://nnm-club.me/forum/viewforum.php?f=225 ... filtered by ABE <LOCAL> Deny".
Now I open this link and there is NO ANY error...
Here the screenshot:
Image

Re: ABE on nnm-club.me

Posted: Sat Jun 20, 2015 4:55 pm
by barbaz
Oh... that's a rather different beast. Please post the message(s) from ABE that you see in the Browser Console (Ctrl-Shift-J) when this happens, also do a reverse DNS lookup on nnm-club.me (use nslookup in a command prompt) and please post that too.

Possible workaround (but the above information is needed to determine whether this is safe):
add to the very top of the SYSTEM ruleset

Code: Select all

Site nnm-club.me
Accept from nnm-club.me