Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I use UrlScan to block common SQL Injection attempts on asp- and aspx-files, I would do something like this:

[SQLInjection] 
AppliesTo=.asp,.aspx
DenyDataSection=SQLInjectionStrings 
ScanURL=0 
ScanAllRaw=0 
ScanQueryString=1 
ScanHeaders=
[SQLInjectionStrings] 
-- 
alter 
delete 
(...)

That would catch

/default.asp?EVILACTION=DELETEDROPSLASHANDBURN
/default.aspx?EVILACTION=DELETEDROPSLASHANDBURN

But NOT

/?EVILACTION=DELETEDROPSLASHANDBURN 

How can I make an Urlscan section apply to extensionless urls too?

I tried ., leaving it blank etc - no luck.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Instead of leaving it blank, simply omit the AppliesTo flag entirely. If you don't have it at all, it should apply to all requests. If you specify it, but leave the value blank, it won't apply to any requests.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.