Post Reply 
User-Agents.ptxt update 2012-07-06.
Jul. 22, 2012, 07:41 PM (This post was last modified: Dec. 27, 2013 04:10 AM by JJoe.)
Post: #1
User-Agents.ptxt update 2012-07-06.
Added entry for IE9.
Allowing trident, chrome, safari, and presto values due to picky servers.

"Fake" strings may need to be updated.

Code:
###############################################################################
#  NoHash
#  NOADDURL $LST(User-Agents) -- Naoko 4.5
#  Manage listed User-Agents
#
#  List for the header filter "User-Agent: Manage listed Strings".
#
#  sidki 2002-09-03
#  Last updated 2010-10-03
#  JJoe 2012-07-06 Added NoHash; Add IE9
#       ; Allow trident, chrome, safari, and presto values due to picky servers
#
#
###############################################################################


## |||||||||||||||||||||||||||||| Kill connection |||||||||||||||||||||||||||||

## Winamp Lyrics Plugin
## ----------------------------------------------------------------------------
UtilMind HTTPGet    $SET(1=\0$RDIR(http://local.ptron/killed.gif))


## ||||||||||||||||||||||||||||| Bypass webfilters ||||||||||||||||||||||||||||

## Flash (POST, application/x-fcs)
## ----------------------------------------------------------------------------
Shockwave Flash            $SET(1=\0$FILTER(0))

## XP Search Assistant (text/xml)
## ----------------------------------------------------------------------------
SCAgent                $SET(1=\0$FILTER(0))

## WinBatch (text/plain)
## ----------------------------------------------------------------------------
WinBatch Internet Extender Ver:    $SET(1=\0$FILTER(0))


## ||||||||||||||||||||||||||| "Correct" user-agent |||||||||||||||||||||||||||

## If MSIE:
## ----------------------------------------------------------------------------
#Mozilla/4.0(^$TST(keyword=*.f_ua_(^[a-z]++ie)*)) \(compatible; MSIE(^ 5.01)\2;
#  $SET(1=Mozilla/4.0 (compatible; MSIE\2; Windows NT 6.1))

Mozilla/([4-9].0)\3(^$TST(keyword=*.f_ua_(^[a-z]++ie)*))
  \(compatible; MSIE(^ 5.01)\2;(*(trident/[4-9].0)\4[;\)])+
  $SET(1=Mozilla/\3 (compatible; MSIE\2; Windows NT 6.1; \4))

## If Firefox, SeaMonkey, Chrome, Safari:
## ----------------------------------------------------------------------------
#Mozilla/5.0(^$TST(keyword=*.f_ua_(^[a-z]++moz)*))(*(; rv:*Gecko/[#*:*]
#  ( Firefox/[#*:*].[#*:*]$SET(3=.9.9)|)|\)
#  (*\s(Gecko/[#*:*]|AppleWebKit/(*.)+{1}$SET(3=99))|))\2
#  [0-9.]+( $NEST(\(,*gecko*,\))|)\4|$SET(2=\)))
#  $SET(1=Mozilla/5.0 \(Windows; U; Windows NT 6.1; en-US\2\3\4)

Mozilla/5.0(^$TST(keyword=*.f_ua_(^[a-z]++moz)*))
  (*\()+{1}Windows nt
  (*(; rv:*Gecko/[#*:*]
  ( Firefox/[#*:*].[#*:*]$SET(3=.9.9)|)|\)
  (*\s(Gecko/[#*:*]|AppleWebKit/(*.)+{1}$SET(3=99))|))\2
  [0-9.]+( $NEST(\(,*gecko*,\))|)\4|$SET(2=\)))
  (( (Chrome/|Safari/)[0-9][0-9.]+)+)\5
  $SET(1=Mozilla/5.0 \(Windows NT 6.1; en-US\2\3\4\5)

Mozilla/5.0(^$TST(keyword=*.f_ua_(^[a-z]++moz)*))
  (*\()+{1}Windows;
  (*(; rv:*Gecko/[#*:*]
  ( Firefox/[#*:*].[#*:*]$SET(3=.9.9)|)|\)
  (*\s(Gecko/[#*:*]|AppleWebKit/(*.)+{1}$SET(3=99))|))\2
  [0-9.]+( $NEST(\(,*gecko*,\))|)\4|$SET(2=\)))
  (( (Chrome/|Safari/)[0-9][0-9.]+)+)\5
  $SET(1=Mozilla/5.0 \(Windows; U; Windows NT 6.1; en-US\2\3\4\5)
  
## If Opera:
## ----------------------------------------------------------------------------
#Opera/(^$TST(keyword=*.f_ua_(^[a-z]++op)*))(\w)\2
#  (*(\sVersion/[#*:*].[0-9]$SET(4=9))\3|)
#  $SET(1=Opera/\2 (Windows NT 6.1; U)\3\4)

Opera/(^$TST(keyword=*.f_ua_(^[a-z]++op)*))(\w)\2
  ((*(\s(Presto/[0-9.][0-9.]+|Version/[#*:*].[0-9]$SET(#=9)))\#)+|)
  $SET(1=Opera/\2 (Windows NT 6.1; U)\@)
  
## |||||||||||||||||||||||||||||| Fake user-agent |||||||||||||||||||||||||||||

## Keywords:
##   f_ua_ie            -> fake MSIE
##   f_ua_iemoz         -> fake MSIE, if not IE or Mozilla
##   f_ua_moz           -> fake Mozilla
##   f_ua_mozie         -> fake Mozilla, if not IE or Mozilla
##   f_ua_op            -> fake Opera
##   f_ua_opie          -> fake Opera, if not IE or Opera
##   f_ua_sp            -> fake Space Bison
##   f_ua_gbot          -> fake Googlebot
##   f_ua_┬žAnything     -> fake unescaped "Anything"
## ----------------------------------------------------------------------------
$TST(keyword=*.f_ua_(
  ie.(^$TST(hOrigUA=*MSIE(^*Opera)*))
  $SET(1=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1))
|iemoz.(^$TST(hOrigUA=*(Gecko/|MSIE(^*Opera))*))
  $SET(1=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1))
|moz.(^$TST(hOrigUA=*Gecko/*))
  $SET(1=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0)
|mozie.(^$TST(hOrigUA=*(Gecko/|MSIE(^*Opera))*))
  $SET(1=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0)
|op.(^$TST(hOrigUA=*Opera*))
  $SET(1=Opera/9.20 (Windows NT 6.1; U; en))
|opie.(^$TST(hOrigUA=*(Opera|MSIE)*))
  $SET(1=Opera/9.20 (Windows NT 6.1; U; en))
|sp.
  $SET(1=Space Bison/0.02 [fu] (Win67; X; SK))
|gbot.
  $SET(1=Googlebot/3.0 Beta (+http://www.googlebot.com/bot.html))
|┬ž\2.$SET(1=$UESC(\2))
)*)


Attached File(s)
.ptxt  User-Agents.ptxt (Size: 4.7 KB / Downloads: 341)
Add Thank You Quote this message in a reply
[-] The following 4 users say Thank You to JJoe for this post:
whenever, fpout, chatterer, usr
Feb. 03, 2013, 11:56 AM (This post was last modified: Feb. 03, 2013 11:57 AM by chatterer.)
Post: #2
RE: User-Agents.ptxt update.
Hi,

i have a little problem. In my log i see "User-Agent: Opera/9.80 (Windows NT 6.1; U) Presto/2.12.388 Version/12.19" but my Opera version is 12.13 ... ?? Is this to fake the version or is it an error?

cheerz,
chatterer
Add Thank You Quote this message in a reply
Feb. 04, 2013, 12:45 AM
Post: #3
RE: User-Agents.ptxt update.
(Feb. 03, 2013 11:56 AM)chatterer Wrote:  Is this to fake the version or is it an error?

IIRC, the 9 was added to give sidki some idea of how many people were using his set.
Add Thank You Quote this message in a reply
Feb. 04, 2013, 04:06 AM
Post: #4
RE: User-Agents.ptxt update.
(Feb. 04, 2013 12:45 AM)JJoe Wrote:  ...how many people were using his set.

more than he thinks Wink
Add Thank You Quote this message in a reply
Post Reply 


Forum Jump: