I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request causes a server error, which triggers an error report into my inbox. Over the last 3 days, I have had almost 2000 emails every night.
We are a .net shop and do not have any php in the site they are attacking. I want to block all requests for .cgi, .php, and .ini filetypes. This is easy enought in File Name Extensions inside of Request Filtering in IIS. That handles requests like this one:
My problem is an exploit they are trying to use around an error page:
So for this one, I just want to look in the url and if .cgi is found, block the request. How would I do this? I may also want to block requests that have ../ in them.