Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a legacy app running a third-party ecommerce system under IIS6. Some spammers recently discovered a bad security vulnerability in one of the store's forms, which are allowing them to send arbitrary emails from our system. Unfortunately, this store "feature" is built into the default.aspx page's code-behind and I have no way to disable it without shutting down the store.

How can I filter out URL request with a given querystring parameter? ie, I want to filter out requests to:

http://www.mysite.com/store/?id=SendSpam

based on the "SendSpam" string.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

First solution: use an isapi filter which simulate Apache's ModRewrite for IIS. Search for "mod_rewrite iis".

Another approach would be to write an httpmodule in .net which would implement an input filter, and you load it in your .net application in the web.config.

Note that none of these will allow you to alter the querystring parameter, but they will let you make a redirection or a 403 Forbidden response before your application is hit.

share|improve this answer
    
Perfect, thanks. –  user21146 Nov 12 '11 at 18:47
add comment

Or there's urlscan from Microsoft, which should be able to do what's been described above.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.