A Browser Exploit That Doesn't Affect IE

Code:
[Patterns]

Name = "IDN "xn--" URL Remover [Kye-U]"

Active = TRUE

URL = "(*.|)xn--"

Limit = 1

Match = "?"

Replace = "\k"

 "<b><font face="sans-serif" color="Red" size="6">Connection Killed - Proxomitron</font>"

 "<br><br><font face="sans-serif" color="Red" size="3">This is an <b>IDN Spoofed</b> Site!"

 "<br><br>Real URL: \u</font></b>"



Name = "Spoofed Address Exploit [Kye-U]"

Active = TRUE

URL = "(^$TYPE(css))"

Bounds = "($NEST(<(([a-z]+{1,*})|*=\s),</([a-z]+{1,*})>)|$NEST(<(([a-z]+{1,*})|*=\s),>))"

Limit = 1024

Match = "\0://(\1.([a-z]+{2,4})|*.*/)((?%00|(((%|&#)0[01])+{1,2})))[^/]++[@|%40]\2"

"|\0://(\1.([a-z]+{2,4})|*.*/)%2F((%20|\s)+{1,*})[^/]++.\2"

"|\0://(\1.([a-z]+{2,4})|*.*/)%(2F|01)[@|%40]\2"

"|\0://(\w.|)\w(&#*;|%[a-z0-9][a-z0-9])\w.([a-z]+{2,4})*"

"|\0://(*|)xn--*.([a-z]+{2,4})*"

"$SET(\9=Think you're on Microsoft but you're on Yahoo? This filter will prevent the threat of such a situation."

""

"http://www.securityfocus.com/bid/10517/info/"

"http://secunia.com/advisories/10395/"

"http://www.securityfocus.com/bid/10532/info/)"

Replace = "<strong>[URL Spoofing Exploit Removed]</strong>"

 "$ALERT(URL Spoofing Vulnerability Detected and Removed on:\n\n\u)"