cxs

Changes:

• Updated installer to fix generic installs on some Redhat/CentOS setups
• Fixed issue with fingerprint database and a corrupt regex
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Improvements to .htaccess fingerprint P0216 -> P0767
• Modify installer to always perform an update on installation to ensure the latest definitions are always available
• cxswatch will now scan a directories permissions if any of its attributes are changed and –options [w] and/or –options [W] is enabled
• Updated scripts to use download.configserver.com
• Exploit fingerprint definitions database additions

Changes:

• Removed a false-postitive fingerprint definition
• Exploit fingerprint definitions database additions

Changes:

• Ensure –ignore [file] is always loaded last
• Allow ignoring of Fingerprints
• New master bayes corpus generated
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Raised bayes low/medium/high thresholds
• New master bayes corpus generated
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• New feature –[no]bayes taken out of BETA and is the basis of v5
• Added –[no]bayes to the UI
• New master bayes corpus generated
• Added warning in UI for –[no]fallback option regarding potential performance impact
• Exploit fingerprint definitions database additions

Changes:

• Fixed cxs Watch loading the bayes database whether –bayes was in use or not

Changes:

• Modified cxs Watch so that watches are updated/created if the alternative configuration file reload method is used
• Exploit fingerprint definitions database additions
• BETA: Added a local bayes corpus so that learning and forgetting can be implemented locally
• BETA: Added new option –blearn [X|C] so that new files can be added to the local corpus as either an exploit (X) or as a clean file (C)
• BETA: Added new option –bforget [X|C] so that new files can be removed from the local corpus as either an exploit (X) or as a clean file (C). Only files previously learned should be forgotten
• BETA: Modified cxs Watch to reload the master bayes corpus on change
• BETA: Modified cxs Watch to reload the local bayes corpus, if one exists, on change
• BETA: When cxs is upgraded and the master bayes corpus exists, the latest master corpus will be automatically downloaded
• BETA: New master bayes corpus generated
• BETA: Raised bayes low/medium/high thresholds

Changes:

• A situation where Fingerprint P0452 persists was missed and is now removed

Changes:

• Fingerprint P0452 removed as it appears some legitimate scripts are using the same obfuscation technique commonly used in exploits
• BETA: Bayes corpus size decreased by a further 28% but with increased accuracy
• Exploit fingerprint definitions database additions