deleted file mode 100644

@@ -1,36 +0,0 @@

-# Base package

-

-## Supported platforms

-

-Clam AntiVirus is highly cross-platform.  The development team cannot test every OS, so have chosen to test ClamAV using the two most recent Long Term Support (LTS) versions of each of the most popular desktop operating systems.  Our selection includes:

-

-- GNU/Linux

-  - Ubuntu

-    - 14.04

-    - 16.04

-  - Debian

-    - 7

-    - 8

-  - CentOS

-    - 6

-    - 7

-- UNIX

-  - Solaris

-    - 10

-    - 11

-  - FreeBSD

-    - 10

-    - 11

-  - macOS

-    - 10.12 (Sierra)

-    - 10.13 (High Sierra)

-- Windows

-  - 7

-  - 10

-

-## Binary packages

-

-As an alternative to building and installing from source, most Linux package managers provide pre-compiled ClamAV packages.

-

-For more information about installing ClamAV via a Package Manager, please visit:

-<https://www.clamav.net/download.html#otherversions>

deleted file mode 100644

@@ -1,26 +0,0 @@

-# Clam AntiVirus 0.100.0 *User Manual*

-

-![image](images/demon.png)

-

-

-Table Of Contents

-

-1. [Introduction](Introduction.md)

-2. [Base Package](BasePackage.md)

-3. [Installation](Installation.md)

-4. [Configuration](Configuration.md)

-5. [Usage](Usage.md)

-6. [libclamav](libclamav.md)

-7. [Signatures](Signatures.md)

-8. [PhishSigs](PhishSigs.md)

-

-

-ClamAV User Manual © 2018 Cisco Systems, Inc.

-

-This document is distributed under the terms of the GNU General Public License v2.

-

-Clam AntiVirus is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

-

-ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc.

deleted file mode 100644

@@ -1,105 +0,0 @@

-# Configuration

-

-Before proceeding with the steps below, you should run the ’clamconf’ command, which gives important information about your ClamAV configuration. See section [5.8](#sec:clamconf) for more details.

-

-## clamd

-

-Before you start using the daemon you have to edit the configuration file (in other case `clamd` won’t run):

-

-```bash

-    $ clamd

-    ERROR: Please edit the example config file /etc/clamd.conf.

-```

-

-This shows the location of the default configuration file. The format and options of this file are fully described in the *clamd.conf(5)* manual. The config file is well commented and configuration should be straightforward.

-

-### On-access scanning

-

-One of the interesting features of `clamd` is on-access scanning based on fanotify, included in Linux since kernel 2.6.36. **This is not required to run clamd**. At the moment the fanotify header is only available for Linux.

-

-Configure on-access scanning in `clamd.conf` and read the [on-access](Usage.md#On-access-Scanning) section for on-access scanning usage.

-

-## clamav-milter

-

-ClamAV (v0.95) includes a new, redesigned clamav-milter. The most notable difference is that the internal mode has been dropped and now a working clamd companion is required. The second important difference is that now the milter has got its own configuration and log files.

-

-To compile ClamAV with the clamav-milter just run `./configure --enable-milter` and make as usual. In order to use the `–enable-milter` option with `configure`, your system MUST have the milter library installed. If you use the `–enable-milter` option without the library being installed, you will most likely see output like this during ’configure’:

-

-```bash

-        checking for libiconv_open in -liconv... no

-        checking for iconv... yes

-        checking whether in_port_t is defined... yes

-        checking for in_addr_t definition... yes

-        checking for mi_stop in -lmilter... no

-        checking for library containing strlcpy... no

-        checking for mi_stop in -lmilter... no

-        configure: error: Cannot find libmilter

-```

-

-At which point the ’configure’ script will stop processing.

-

-Please consult your MTA’s manual on how to connect ClamAV with the milter.

-

-## Testing

-

-Try to scan recursively the source directory:

-

-```bash

-    $ clamscan -r -l scan.txt clamav-x.yz

-```

-

-It should find some test files in the clamav-x.yz/test directory. The scan result will be saved in the `scan.txt` log file \[7\]. To test `clamd`, start it and use `clamdscan` (or instead connect directly to its socket and run the SCAN command):

-

-```bash

-    $ clamdscan -l scan.txt clamav-x.yz

-```

-

-Please note that the scanned files must be accessible by the user running `clamd` or you will get an error.

-

-## Setting up auto-updating

-

-`freshclam` is the automatic database update tool for Clam AntiVirus. It can work in two modes:

-

-- interactive - on demand from command line

-- daemon - silently in the background

-

-`freshclam` is advanced tool: it supports scripted updates (instead of transferring the whole CVD file at each update it only transfers the differences between the latest and the current database via a special script), database version checks through DNS, proxy servers (with authentication), digital signatures and various error scenarios. **Quick test: run freshclam (as superuser) with no parameters and check the output.** If everything is OK you may create the log file in /var/log (owned by *clamav* or another user `freshclam` will be running as):

-

-```bash

-    # touch /var/log/freshclam.log

-    # chmod 600 /var/log/freshclam.log

-    # chown clamav /var/log/freshclam.log

-```

-

-Now you *should* edit the configuration file `freshclam.conf` and point the *UpdateLogFile* directive to the log file. Finally, to run `freshclam` in the daemon mode, execute:

-

-```bash

-    # freshclam -d

-```

-

-The other way is to use the *cron* daemon. You have to add the following line to the crontab of **root** or **clamav** user:

-

-```cron

-N * * * *   /usr/local/bin/freshclam --quiet

-```

-

-to check for a new database every hour. **N should be a number between 3 and 57 of your choice. Please don’t choose any multiple of 10, because there are already too many clients using those time slots.** Proxy settings are only configurable via the configuration file and `freshclam` will require strict permission settings for the config file when `HTTPProxyPassword` is turned on.

-

-```bash

-    HTTPProxyServer myproxyserver.com

-    HTTPProxyPort 1234

-    HTTPProxyUsername myusername

-    HTTPProxyPassword mypass

-```

-

-### Closest mirrors

-

-The `DatabaseMirror` directive in the config file specifies the database server `freshclam` will attempt (up to `MaxAttempts` times) to download the database from. The default database mirror is [database.clamav.net](database.clamav.net) but multiple directives are allowed. In order to download the database from the closest mirror you should configure `freshclam` to use [db.xx.clamav.net](db.xx.clamav.net) where xx represents your country code. For example, if your server is in "Ascension Island" you should have the following lines included in `freshclam.conf`:

-

-```bash

-    DNSDatabaseInfo current.cvd.clamav.net

-    DatabaseMirror db.ac.clamav.net

-    DatabaseMirror database.clamav.net

-```

-

-The second entry acts as a fallback in case the connection to the first mirror fails for some reason. The full list of two-letters country codes is available at <http://www.iana.org/cctld/cctld-whois.htm>

deleted file mode 100644

@@ -1,190 +0,0 @@

-# Installation

-

-## Requirements

-

-The following components are required to compile ClamAV under UNIX:=

-

-- zlib and zlib-devel packages

-- openssl version 0.9.8 or higher and libssl-devel packages

-- gcc compiler suite (tested with 2.9x, 3.x and 4.x series) **If you are compiling with higher optimization levels than the default one ( for gcc), be aware that there have been reports of misoptimizations. The build system of ClamAV only checks for bugs affecting the default settings, it is your responsibility to check that your compiler version doesn’t have any bugs.**

-- GNU make (gmake)

-

-The following packages are optional but **highly recommended**:

-

-- bzip2 and bzip2-devel library

-- libxml2 and libxml2-dev library

-- `check` unit testing framework \[3\].

-

-The following packages are optional, but **required for bytecode JIT support**:

-

-- GCC C and C++ compilers (minimum 4.1.3, recommended 4.3.4 or newer) the package for these compilers are usually called: gcc, g++, or gcc-c++. \[5\]

-- OSX Xcode versions prior to 5.0 use a g++ compiler frontend (llvm-gcc) that is not compatible with ClamAV JIT. It is recommended to either compile ClamAV JIT with clang++ or to compile ClamAV without JIT.

-- A supported CPU for the JIT, either of: X86, X86-64, PowerPC, PowerPC64

-

-The following packages are optional, but needed for the JIT unit tests:

-

-- GNU Make (version 3.79, recommended 3.81)

-- Python (version 2.5.4 or newer), for running the JIT unit tests

-

-The following packages are optional, but required for clamsubmit:

-

-- libcurl-devel library

-- libjson-c-dev library

-

-## Installing on shell account

-

-To install ClamAV locally on an unprivileged shell account you need not create any additional users or groups. Assuming your home directory is `/home/gary` you should build it as follows:

-

-```bash

-    $ ./configure --prefix=/home/gary/clamav --disable-clamav

-    $ make; make install

-```

-

-To test your installation execute:

-

-```bash

-    $ ~/clamav/bin/freshclam

-    $ ~/clamav/bin/clamscan ~

-```

-

-The `--disable-clamav` switch disables the check for existence of the *clamav* user and group but `clamscan` would still require an unprivileged account to work in a superuser mode.

-

-## Adding new system user and group

-

-If you are installing ClamAV for the first time, you have to add a new user and group to your system:

-

-```bash

-    # groupadd clamav

-    # useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav

-```

-

-Consult a system manual if your OS has not *groupadd* and *useradd* utilities. **Don’t forget to lock access to the account\!**

-

-## Compilation of base package

-

-Once you have created the clamav user and group, please extract the archive:

-

-```bash

-    $ zcat clamav-x.yz.tar.gz | tar xvf -

-    $ cd clamav-x.yz

-```

-

-Assuming you want to install the configuration files in /etc, configure and build the software as follows:

-

-```bash

-    $ ./configure --sysconfdir=/etc

-    $ make

-    $ su -c "make install"

-```

-

-In the last step the software is installed into the /usr/local directory and the config files into /etc. **WARNING: Never enable the SUID or SGID bits for Clam AntiVirus binaries.**

-

-## Compilation with clamav-milter enabled

-

-libmilter and its development files are required. To enable clamav-milter, configure ClamAV with

-

-```bash

-    $ ./configure --enable-milter

-```

-

-See section /refsec:clamavmilter for more details on clamav-milter.

-

-## Using the system LLVM

-

-Some problems have been reported when compiling ClamAV’s built-in LLVM with recent C++ compiler releases. These problems may be avoided by installing and using an external LLVM system library. To configure ClamAV to use LLVM that is installed as a system library instead of the built-in LLVM JIT, use following:

-

-```bash

-    $ ./configure --with-system-llvm=/myllvm/bin/llvm-config

-    $ make

-    $ sudo make install

-```

-

-The argument to `--with-system-llvm` is optional, indicating the path name of the LLVM configuration utility (llvm-config). With no argument to `--with-system-llvm`, `./configure` will search for LLVM in /usr/local/ and then /usr.

-

-Recommended versions of LLVM are 3.2, 3.3, 3.4, 3.5, and 3.6. Some installations have reported problems using earlier LLVM versions. Versions of LLVM beyond 3.6 are not currently supported in ClamAV.

-

-## Running unit tests

-

-ClamAV includes unit tests that allow you to test that the compiled binaries work correctly on your platform.

-

-The first step is to use your OS’s package manager to install the `check` package. If your OS doesn’t have that package, you can download it from <http://check.sourceforge.net/>, build it and install it.

-

-To help clamav’s configure script locate `check`, it is recommended that you install `pkg-config`, preferably using your OS’s package manager, or from <http://pkg-config.freedesktop.org>.

-

-The recommended way to run unit-tests is the following, which ensures you will get an error if unit tests cannot be built: \[6\]

-

-```bash

-     $ ./configure --enable-check

-     $ make

-     $ make check

-```

-

-When `make check` is finished, you should get a message similar to this:

-

-```bash

-==================

-All 8 tests passed

-==================

-```

-

-If a unit test fails, you get a message similar to the following. Note that in older versions of make check may report failures due to the absence of optional packages. Please make sure you have the latest versions of the components noted in section /refsec:components. See the next section on how to report a bug when a unit test fails.

-

-```bash

-========================================

-1 of 8 tests failed

-Please report to https://bugzilla.clamav.net/

-========================================

-```

-

-If unit tests are disabled (and you didn’t use –enable-check), you will get this message:

-

-```bash

-*** Unit tests disabled in this build

-*** Use ./configure --enable-check to enable them

-

-SKIP: check_clamav

-PASS: check_clamd.sh

-PASS: check_freshclam.sh

-PASS: check_sigtool.sh

-PASS: check_clamscan.sh

-======================

-All 4 tests passed

-(1 tests were not run)

-======================

-```

-

-Running `./configure --enable-check` should tell you why.

-

-## Reporting a unit test failure bug

-

-If `make check` says that some tests failed we encourage you to report a bug on our bugzilla: <https://bugzilla.clamav.net>. The information we need is:

-

-- The exact output from `make check`

-- Output of `uname -mrsp`

-- your `config.log`

-- The following files from the `unit_tests/` directory:

-  - `test.log`

-  - `clamscan.log`

-  - `clamdscan.log`

-

-- `/tmp/clamd-test.log` if it exists

-- where and how you installed the check package

-- Output of `pkg-config check --cflags --libs`

-- Optionally if `valgrind` is available on your platform, the output of the following:

-    ```bash

-    $ make check

-    $ CK_FORK=no ./libtool --mode=execute valgrind unit_tests/check_clamav

-    ```

-

-## Obtain Latest ClamAV anti-virus signature databases

-

-Before you can run ClamAV in daemon mode (clamd), ’clamdscan’, or ’clamscan’ which is ClamAV’s command line virus scanner, you must have ClamAV Virus Database (.cvd) file(s) installed in the appropriate location on your system. The default location for these database files are /usr/local/share/clamav (in Linux/Unix).

-

-Here is a listing of currently available ClamAV Virus Database Files:

-

-- bytecode.cvd (signatures to detect bytecode in files)

-- main.cvd (main ClamAV virus database file)

-- daily.cvd (daily update file for ClamAV virus databases)

-- safebrowsing.cvd (virus signatures for safe browsing)

-

-These files can be downloaded via HTTP from the main ClamAV website or via the ’freshclam’ utility on a periodic basis. Using ’freshclam’ is the preferred method of keeping the ClamAV virus database files up to date without manual intervention (see the [freshclam configuration](Configuration.md#Setting-up-auto\-updating) section for information on how to configure ’freshclam’ for automatic updating and the main [freshclam](Usage.md#freshclam) section for additional details on freshclam).

deleted file mode 100644

@@ -1,85 +0,0 @@

-# Introduction

-

-Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.

-

-## Features

-

-- Licensed under the GNU General Public License, Version 2

-- POSIX compliant, portable

-- Fast scanning

-- Supports on-access scanning (Linux only)

-- Detects over 1 million viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats

-- Built-in bytecode interpreter allows the ClamAV signature writers to create and distribute very complex detection routines and remotely enhance the scanner’s functionality

-- Scans within archives and compressed files (also protects against archive bombs), built-in support includes:

-  - Zip (including SFX)

-  - RAR (including SFX)

-  - 7Zip

-  - ARJ (including SFX)

-  - Tar

-  - CPIO

-  - Gzip

-  - Bzip2

-  - DMG

-  - IMG

-  - ISO 9660

-  - PKG

-  - HFS+ partition

-  - HFSX partition

-  - APM disk image

-  - GPT disk image

-  - MBR disk image

-  - XAR

-  - XZ

-  - MS OLE2

-  - MS Cabinet Files (including SFX)

-  - MS CHM (Compiled HTML)

-  - MS SZDD compression format

-  - BinHex

-  - SIS (SymbianOS packages)

-  - AutoIt

-  - InstallShield

-- Supports Portable Executable (32/64-bit) files compressed or obfuscated with:

-  - AsPack

-  - UPX

-  - FSG

-  - Petite

-  - PeSpin

-  - NsPack

-  - wwpack32

-  - MEW

-  - Upack

-  - Y0da Cryptor

-- Supports ELF and Mach-O files (both 32- and 64-bit)

-- Supports almost all mail file formats

-- Support for other special files/formats includes:

-  - HTML

-  - RTF

-  - PDF

-  - Files encrypted with CryptFF and ScrEnc

-  - uuencode

-  - TNEF (winmail.dat)

-- Advanced database updater with support for scripted updates, digital signatures and DNS based database version queries

-

-## Mailing lists and IRC channel

-

-If you have a trouble installing or using ClamAV try asking on our mailing lists. There are four lists available:

-

-- **clamav-announce\*lists.clamav.net** - info about new versions, moderated\[1\].

-- **clamav-users\*lists.clamav.net** - user questions

-- **clamav-devel\*lists.clamav.net** - technical discussions

-- **clamav-virusdb\*lists.clamav.net** - database update announcements, moderated

-

-You can subscribe and search the mailing list archives at: <https://www.clamav.net/contact.html#ml>

-

-Alternatively you can try asking on the `#clamav` IRC channel - launch your favourite irc client and type:

-

-```bash

-    /server irc.freenode.net

-    /join #clamav

-```

-

-## Virus submitting

-

-If you have got a virus which is not detected by your ClamAV with the latest databases, please submit the sample at our website:

-

-<https://www.clamav.net/reports/malware>

\ No newline at end of file

deleted file mode 100644

@@ -1,681 +0,0 @@

-# PhishSigs

-

-- [PhishSigs](#phishsigs)

-- [Database file format](#database-file-format)

-  - [PDB format](#pdb-format)

-  - [GDB format](#gdb-format)

-  - [WDB format](#wdb-format)

-  - [Hints](#hints)

-  - [Examples of PDB signatures](#examples-of-pdb-signatures)

-  - [Examples of WDB signatures](#examples-of-wdb-signatures)

-  - [Example for how the URL extractor works](#example-for-how-the-url-extractor-works)

-  - [How matching works](#how-matching-works)

-    - [RealURL, displayedURL concatenation](#realurl-displayedurl-concatenation)

-    - [What happens when a match is found](#what-happens-when-a-match-is-found)

-    - [Extraction of realURL, displayedURL from HTML tags](#extraction-of-realurl-displayedurl-from-html-tags)

-    - [Example](#example)

-  - [Simple patterns](#simple-patterns)

-  - [Regular expressions](#regular-expressions)

-  - [Flags](#flags)

-- [Introduction to regular expressions](#introduction-to-regular-expressions)

-  - [Special characters](#special-characters)

-  - [Character classes](#character-classes)

-  - [Escaping](#escaping)

-  - [Alternation](#alternation)

-  - [Optional matching, and repetition](#optional-matching-and-repetition)

-  - [Groups](#groups)

-- [How to create database files](#how-to-create-database-files)

-  - [How to create and maintain the whitelist (daily.wdb)](#how-to-create-and-maintain-the-whitelist-dailywdb)

-  - [How to create and maintain the domainlist (daily.pdb)](#how-to-create-and-maintain-the-domainlist-dailypdb)

-  - [Dealing with false positives, and undetected phishing mails](#dealing-with-false-positives-and-undetected-phishing-mails)

-    - [False positives](#false-positives)

-    - [Undetected phish mails](#undetected-phish-mails)

-

-# Database file format

-

-## PDB format

-

-This file contains urls/hosts that are target of phishing attempts. It

-contains lines in the following format:

-

-```

-    R[Filter]:RealURL:DisplayedURL[:FuncLevelSpec]

-    H[Filter]:DisplayedHostname[:FuncLevelSpec]

-```

-

-- `R`

-

-  regular expression, for the concatenated URL

-

-- `H`

-

-  matches the `DisplayedHostname` as a simple pattern (literally, no regular expression)

-

-  - the pattern can match either the full hostname

-

-  - or a subdomain of the specified hostname

-

-  - to avoid false matches in case of subdomain matches, the engine checks that there is a dot(`.`) or a space(` `) before the matched portion

-

-- `Filter`

-

-  is ignored for R and H for compatibility reasons

-

-- `RealURL`

-

-  is the URL the user is sent to, example: *href* attribute of an html anchor (*\<a\> tag*)

-

-- `DisplayedURL`

-

-  is the URL description displayed to the user, where its *claimed* they are sent, example: contents of an html anchor (*\<a\> tag*)

-

-- `DisplayedHostname`

-

-  is the hostname portion of the DisplayedURL

-

-- `FuncLevelSpec`

-

-  an (optional) functionality level, 2 formats are possible:

-

-  - `minlevel` all engines having functionality level \>= `minlevel` will load this line

-

-  - `minlevel-maxlevel` engines with functionality level \(>=\) `minlevel`, and \(<\) `maxlevel` will load this line

-

-## GDB format

-

-This file contains URL hashes in the following format:

-

-    S:P:HostPrefix[:FuncLevelSpec]

-    S:F:Sha256hash[:FuncLevelSpec]

-    S1:P:HostPrefix[:FuncLevelSpec]

-    S1:F:Sha256hash[:FuncLevelSpec]

-    S2:P:HostPrefix[:FuncLevelSpec]

-    S2:F:Sha256hash[:FuncLevelSpec]

-    S:W:Sha256hash[:FuncLevelSpec]

-

-- `S:`

-

-  These are hashes for Google Safe Browsing - malware sites, and should not be used for other purposes.

-

-- `S2:`

-

-  These are hashes for Google Safe Browsing - phishing sites, and should not be used for other purposes.

-

-- `S1:`

-

-  Hashes for blacklisting phishing sites. Virus name: Phishing.URL.Blacklisted

-

-- `S:W:`

-

-  Locally whitelisted hashes.

-

-- `HostPrefix`

-

-  4-byte prefix of the sha256 hash of the last 2 or 3 components of the hostname. If prefix doesn’t match, no further lookups are performed.

-

-- `Sha256hash`

-

-  sha256 hash of the canonicalized URL, or a sha256 hash of its prefix/suffix according to the Google Safe Browsing “Performing Lookups” rules. There should be a corresponding `:P:HostkeyPrefix` entry for the hash to be taken into consideration.

-

-To see which hash/URL matched, look at the `clamscan --debug` output, and look for the following strings: `Looking up hash`, `prefix matched`, and `Hash matched`. Local whitelisting of .gdb entries can be done by creating a local.gdb file, and adding a line `S:W:<HASH>`.

-

-## WDB format

-

-This file contains whitelisted url pairs It contains lines in the following format:

-

-```

-    X:RealURL:DisplayedURL[:FuncLevelSpec]

-    M:RealHostname:DisplayedHostname[:FuncLevelSpec]

-```

-

-- `X`

-

-  regular expression, for the *entire URL*, not just the hostname

-

-  - The regular expression is by default anchored to start-of-line and end-of-line, as if you have used `^RegularExpression$`

-

-  - A trailing `/` is automatically added both to the regex, and the input string to avoid false matches

-

-  - The regular expression matches the *concatenation* of the RealURL, a colon(`:`), and the DisplayedURL as a single string. It doesn’t separately match RealURL and DisplayedURL\!

-

-- `M`

-

-  matches hostname, or subdomain of it, see notes for H above

-

-## Hints

-

-- empty lines are ignored

-

-- the colons are mandatory

-

-- Don’t leave extra spaces on the end of a line\!

-

-- if any of the lines don’t conform to this format, clamav will abort with a Malformed Database Error

-

-- see section [Extraction-of-realURL](#Extraction-of-realURL,-displayedURL-from-HTML-tags) for more details on realURL/displayedURL

-

-## Examples of PDB signatures

-

-To check for phishing mails that target amazon.com, or subdomains of

-amazon.com:

-

-```

-    H:amazon.com

-```

-

-To do the same, but for amazon.co.uk:

-

-```

-    H:amazon.co.uk

-```

-

-To limit the signatures to certain engine versions:

-

-```

-    H:amazon.co.uk:20-30

-    H:amazon.co.uk:20-

-    H:amazon.co.uk:0-20

-```

-

-First line: engine versions 20, 21, ..., 29 can load it

-

-Second line: engine versions \>= 20 can load it

-

-Third line: engine versions \< 20 can load it

-

-In a real situation, you’d probably use the second form. A situation like that would be if you are using a feature of the signatures not available in earlier versions, or if earlier versions have bugs with your signature. Its neither case here, the above examples are for illustrative purposes only.

-

-## Examples of WDB signatures

-

-To allow amazon’s country specific domains and amazon.com, to mix domain names in DisplayedURL, and RealURL:

-

-    X:.+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?:17-

-

-Explanation of this signature:

-

-- `X:`

-

-  this is a regular expression

-

-- `:17-`

-

-  load signature only for engines with functionality level \>= 17 (recommended for type X)

-

-The regular expression is the following (X:, :17- stripped, and a / appended)

-

-```

-    .+\.amazon\.(at|ca|co\.uk|co\.jp|de|fr)([/?].*)?:.+\.amazon\.com([/?].*)?/

-```

-

-Explanation of this regular expression (note that it is a single regular expression, and not 2 regular expressions splitted at the :).

-

-- `.+`

-

-  any subdomain of

-

-- `\.amazon\.`

-

-  domain we are whitelisting (RealURL part)

-

-- `(at|ca|co\.uk|co\.jp|de|fr)`

-

-  country-domains: at, ca, co.uk, co.jp, de, fr

-

-- `([/?].*)?`

-

-  recomended way to end real url part of whitelist, this protects against embedded URLs (evilurl.example.com/amazon.co.uk/)

-

-- `:`

-

-  RealURL and DisplayedURL are concatenated via a :, so match a literal : here

-

-- `.+`

-

-  any subdomain of

-

-- `\.amazon\.com`

-

-  whitelisted DisplayedURL

-

-- `([/?].*)?`

-

-  recommended way to end displayed url part, to protect against embedded URLs

-

-- `/`

-

-  automatically added to further protect against embedded URLs

-

-When you whitelist an entry make sure you check that both domains are owned by the same entity. What this whitelist entry allows is: Links claiming to point to amazon.com (DisplayedURL), but really go to country-specific domain of amazon (RealURL).

-

-## Example for how the URL extractor works

-

-Consider the following HTML file:

-

-```html

-    <html>

-    <a href="http://1.realurl.example.com/">

-      1.displayedurl.example.com

-    </a>

-    <a href="http://2.realurl.example.com">

-      2 d<b>i<p>splayedurl.e</b>xa<i>mple.com

-    </a>

-    <a href="http://3.realurl.example.com"> 

-      3.nested.example.com

-      <a href="http://4.realurl.example.com">

-        4.displayedurl.example.com

-      </a>

-    </a>

-    <form action="http://5.realurl.example.com">

-      sometext

-      <img src="http://5.displayedurl.example.com/img0.gif"/>

-      <a href="http://5.form.nested.displayedurl.example.com">

-        5.form.nested.link-displayedurl.example.com

-      </a>

-    </form>

-    <a href="http://6.realurl.example.com">

-      6.displ

-      <img src="6.displayedurl.example.com/img1.gif"/>

-      ayedurl.example.com

-    </a>

-    <a href="http://7.realurl.example.com">

-      <iframe src="http://7.displayedurl.example.com">

-    </a>

-```

-

-The phishing engine extract the following

-RealURL/DisplayedURL pairs from it:

-

-```

-    http://1.realurl.example.com/

-    1.displayedurl.example.com

-

-    http://2.realurl.example.com

-    2displayedurl.example.com

-

-    http://3.realurl.example.com

-    3.nested.example.com

-

-    http://4.realurl.example.com

-    4.displayedurl.example.com

-

-    http://5.realurl.example.com

-    http://5.displayedurl.example.com/img0.gif

-

-    http://5.realurl.example.com

-    http://5.form.nested.displayedurl.example.com

-

-    http://5.form.nested.displayedurl.example.com

-    5.form.nested.link-displayedurl.example.com

-

-    http://6.realurl.example.com

-    6.displayedurl.example.com

-

-    http://6.realurl.example.com

-    6.displayedurl.example.com/img1.gif

-```

-

-## How matching works

-

-### RealURL, displayedURL concatenation

-

-The phishing detection module processes pairs of RealURL/DisplayedURL. Matching against daily.wdb is done as follows: the realURL is concatenated with a `:`, and with the DisplayedURL, then that *line* is matched against the lines in daily.wdb/daily.pdb

-

-So if you have this line in daily.wdb:

-

-    M:www.google.ro:www.google.com

-

-and this href: `<a href='http://www.google.ro'>www.google.com</a>` then it will be whitelisted, but: `<a href='http://images.google.com'>www.google.com</a>` will not.

-

-### What happens when a match is found

-

-In the case of the whitelist, a match means that the RealURL/DisplayedURL combination is considered clean, and no further checks are performed on it.

-

-In the case of the domainlist, a match means that the RealURL/displayedURL is going to be checked for phishing attempts.

-

-Furthermore you can restrict what checks are to be performed by specifying the 3-digit hexnumber.

-

-### Extraction of realURL, displayedURL from HTML tags

-

-The html parser extracts pairs of realURL/displayedURL based on the following rules.

-

-In version 0.93: After URLs have been extracted, they are normalized, and cut after the hostname. `http://test.example.com/path/somecgi?queryparameters` becomes `http://test.example.com/`

-

-- `a`

-

-  (anchor) the *href* is the realURL, its *contents* is the displayedURL

-

-  - contents

-    is the tag-stripped contents of the \<a\> tags, so for example \<b\> tags are stripped (but not their contents)

-

-  nesting another \<a\> tag withing an \<a\> tag (besides being invalid html) is treated as a \</a\>\<a..

-

-- `form`

-

-  the *action* attribute is the realURL, and a nested \<a\> tag is the displayedURL

-

-- `img/area`

-

-  if nested within an *\<a\>* tag, the realURL is the *href* of the a tag, and the *src/dynsrc/area* is the displayedURL of the img

-

-  if nested withing a *form* tag, then the action attribute of the *form* tag is the realURL

-

-- `iframe`

-

-  if nested withing an *\<a\>* tag the *src* attribute is the displayedURL, and the *href* of its parent *a* tag is the realURL

-

-  if nested withing a *form* tag, then the action attribute of the *form* tag is the realURL

-

-### Example

-

-Consider this html file:

-

-```html

-<a href=”evilurl”\>www.paypal.com\</a\>*

-

-<a href=”evilurl2” title=”www.ebay.com”\>click here to sign

-in\</a\>*

-

-<form action=”evilurl_form”\>*

-

-*Please sign in to \<a href=”cgi.ebay.com”\>Ebay\</a\using this

-form*

-

-<input type=’text’ name=’username’\>Username\</input\>*

-

-*....*

-

-</form\>*

-

-<a href=”evilurl”\>\<img src=”images.paypal.com/secure.jpg”\>\</a\>*

-```

-

-The resulting realURL/displayedURL pairs will be (note that one tag can generate multiple pairs):

-

-- evilurl / www.paypal.com

-

-- evilurl2 / click here to sign in

-

-- evilurl2 / www.ebay.com

-

-- evilurl_form / cgi.ebay.com

-

-- cgi.ebay.com / Ebay

-

-- evilurl / image.paypal.com/secure.jpg

-

-## Simple patterns

-

-Simple patterns are matched literally, i.e. if you say:

-

-```

-www.google.com

-```

-

-it is going to match *www.google.com*, and only that. The *. (dot)* character has no special meaning (see the section on regexes [\[sec:Regular-expressions\]](#sec:Regular-expressions) for how the *.(dot)* character behaves there)

-

-## Regular expressions

-