|
1
|
# SOCKS Version 5 - Firewall traversal protocol - RFC 1928
|
|
2
|
# Pattern attributes: good notsofast notsofast
|
|
3
|
# Protocol groups: networking ietf_proposed_standard
|
|
4
|
# Wiki: http://www.protocolinfo.org/wiki/SOCKS
|
|
5
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
|
6
|
#
|
|
7
|
# Usually runs on port 1080
|
|
8
|
# Also useful: http://www.iana.org/assignments/socks-methods
|
|
9
|
#
|
|
10
|
# We have had two reports that this pattern works.
|
|
11
|
|
|
12
|
# method request, no private methods \x05[\x01-\x08]*
|
|
13
|
# method reply, assumes sucess \x05[\x01-\x08]?
|
|
14
|
# method dependent sub-negotiation .*
|
|
15
|
# request, ipv4 only \x05[\x01-\x03][\x01\x03].*
|
|
16
|
# reply \x05[\x01-\x08]?[\x01\x03].*
|
|
17
|
|
|
18
|
# username/password method
|
|
19
|
# u/p request, assuming reasonable usernames and passwords
|
|
20
|
# \x05[\x02-\x10][a-z][a-z0-9\-]*[\x05-\x20][!-~]*
|
|
21
|
# server reply
|
|
22
|
# \x05
|
|
23
|
|
|
24
|
# GSSAPI method
|
|
25
|
# client initial token \x01\x01\x02.*
|
|
26
|
# server reply \x01\x01\x02.*
|
|
27
|
|
|
28
|
# any other method .* (all methods boil down to this until we have information
|
|
29
|
# about all the commonly used ones)
|
|
30
|
|
|
31
|
socks
|
|
32
|
\x05[\x01-\x08]*\x05[\x01-\x08]?.*\x05[\x01-\x03][\x01\x03].*\x05[\x01-\x08]?[\x01\x03]
|