Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request causes a server error, which triggers an error report into my inbox. Over the last 3 days, I have had almost 2000 emails every night.

We are a .net shop and do not have any php in the site they are attacking. I want to block all requests for .cgi, .php, and .ini filetypes. This is easy enought in File Name Extensions inside of Request Filtering in IIS. That handles requests like this one:

http://mydomain.com/bin/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=%3C/option%3E%3C/SELECT%3E%3C?phpinfo();?%3E

My problem is an exploit they are trying to use around an error page:

http://mydomain.com/Error/NotFound?404;https://portal.ftnirdc.com:443/bin/webspirs.cgi?sp.nextform=../../../../../../../../../etc/passwd

So for this one, I just want to look in the url and if .cgi is found, block the request. How would I do this? I may also want to block requests that have ../ in them.

share|improve this question
    
It's just a game of whack-a-mole. Focus on securing the pages that do exist against vulnerabilities like the directory traversal and SQL injection they're attempting, and don't stress about attacks against non-existent resources and non-present languages - they're expected background noise. –  Shane Madden Feb 28 '12 at 16:18
    
none of the pages they are querying exist. They are injecting attempts to gain access to the server into the URL. MVC is detecting an attack, throwing an error, and sending me an e-mail. I want the e-mails to stop. This is the 4th day in a row where I have 2000 e-mails in my inbox because someone is trying to get into my site. I want these attempts to see a 404 page, not cause a server error, which puts a report in my error log and sends me an e-mail. –  Josh Feb 29 '12 at 1:39
add comment

1 Answer

Looks like you could do something like this:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <denyUrlSequences>

      <add sequence=".."/>

    </denyUrlSequences>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration> 

Which should filter anything with ".." in the request.

Ref: http://learn.iis.net/page.aspx/143/use-request-filtering/

It is a game of whack a mole, so try not to go too nuts making tons of filters :).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.