Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a legacy app running a third-party ecommerce system under IIS6. Some spammers recently discovered a bad security vulnerability in one of the store's forms, which are allowing them to send arbitrary emails from our system. Unfortunately, this store "feature" is built into the default.aspx page's code-behind and I have no way to disable it without shutting down the store.

How can I filter out URL request with a given querystring parameter? ie, I want to filter out requests to:

based on the "SendSpam" string.

share|improve this question
up vote 0 down vote accepted

First solution: use an isapi filter which simulate Apache's ModRewrite for IIS. Search for "mod_rewrite iis".

Another approach would be to write an httpmodule in .net which would implement an input filter, and you load it in your .net application in the web.config.

Note that none of these will allow you to alter the querystring parameter, but they will let you make a redirection or a 403 Forbidden response before your application is hit.

share|improve this answer
Perfect, thanks. – user21146 Nov 12 '11 at 18:47

Or there's urlscan from Microsoft, which should be able to do what's been described above.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.