Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Guy (full-disclosurenullamatix.com)
Date: Fri Aug 14 2009 - 17:21:37 CDT
> i think it basically means 'to a site thats been configured as allowed in the
> configuration of the BC' - allowed = whitelisted, int he configuration = localdatabase
The Bluecoat 8100-C I'm going through has 27 policies in the "Web
Access Layer." The first policy is configured to "ForceContentFail"
for a list of destinations (a "blacklist" since colors seem to be in).
The next 15 (2-16) policies are all DENY rules for specific hosts,
IPs, regex patters, filenames, etc. The next 10 rules (17-26) are for
destinations that should Bypass Caching. The final rule (27) is,
Source: Any - Destination: Any - Service/Time: Any, Action: Allow.
Google.com isn't listed anywhere in the first 26 policies - anyone on
the LAN can access Google without authenticating. So, if I understand
what you're saying, I should be able to spoof the "Referer" string
sent from my browser to something like www.google.com, or cnn.com,
whatever isn't listed in any of the DENY policies, and not only bypass
authentication, but access sites explicitly defined in the deny
If that's the case, circumventing the auth or accessing "blacklisted"
sites isn't happening. This is good of course; the device is working
as it's supposed to, but I would like to confirm whether or not we're
susceptible to this alleged bypass. So far, looks like a dud... Not
even sure why this would work, it seems too simple.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/