Questions tagged [request-filtering]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
119 views

rewrite based on script in URL

Using Apache 2.2.x -- my usual approach to blocking script kiddies from looking for various scripts on the server is to use dynamically created 'deny from' lists with the offending ip's. Works, but is ...
Johnny Canuck's user avatar
0 votes
1 answer
244 views

allow specific files and block the rest

i tryied to allow specific files in iis 10 MED.exe StartMed.exe and block exe extention with request filtering request filtering but i got this error error message
Shay Rahamim's user avatar
1 vote
0 answers
148 views

How to block those requests?

One of my website seems to be being under attack. I am getting requests, as shown below, from several IPs addresses. Is there a way to block them?
Corobori's user avatar
  • 123
1 vote
1 answer
319 views

What is the order of the processing of modules in IIS?

We have an URL Rewrite rule and a Request Filter. Which one evaluates first?
bugmagnet's user avatar
  • 246
2 votes
1 answer
153 views

In IIS Request Filtering, is the case of the string important?

When in the Edit Filtering Rule dialog in IIS, is the case of the string, e.g. cast( important? We're seeing SQL injection attack attempts that have the string in various combinations of upper- and ...
bugmagnet's user avatar
  • 246
0 votes
1 answer
508 views

How to completely disable request filtering in IIS

My issue is relating to large file uploads (>2 GB) that are getting filtered by IIS request filtering. So how can I completely disable IIS request filtering?
A X's user avatar
  • 519
0 votes
1 answer
435 views

Can IIS 8 Request Filtering inspect/filter form posts?

I have a server which is constantly being attacked by malicious scripts (from various geo-locations, so IP filtering isnt effective) Fortunately, I have determined some of the form post values which ...
Jimbo's user avatar
  • 309
1 vote
0 answers
55 views

How do I prohibit access to a file type except for a few files

Is there a way to configure IIS to prohibit serving a certain type of files, but still allow it for a specific number of files? I need to disallow access to .property files, but there are a few of ...
username's user avatar
  • 249
6 votes
1 answer
15k views

Cannot remove 'Server' header with request filtering

I need to remove the 'Server' header from all http requests coming to my IIS site due to PCI DSS scanning restrictions. I am running the latest version of Windows Server 2016 using the latest version ...
caesay's user avatar
  • 315
1 vote
0 answers
776 views

IIS 8.5 Request Filtering by VERB not working

To disable TRACE/TRACK requests from IIS(Windows 2012 R2), I used the instructions from this tutorial : Verbs <verbs> | Microsoft Docs. I configured to deny OPTIONS, TRACE and TRACK requests. ...
anjanb's user avatar
  • 151
1 vote
1 answer
2k views

Does IIS Request Filtering Rules use Regex for the deny strings?

I'm trying to block user-agent X (literally, just "X") in IIS using Request Filtering Rules. We've done this in the past for other more specific user-agents without problems. However, now that the ...
Effing's user avatar
  • 123
0 votes
1 answer
745 views

UrlScan and Request Filtering long url

Our Windows/IIS 7.5 environment is configured with UrlScan and IIS Request Filtering. We have been facing an issue with a long url. /MyWeb/TestFW/prweb/Servelt1/ZsvSk3vV8PtgJEa4_x3fiQ[[*/!MyWebApp/...
ravi9's user avatar
  • 1
0 votes
1 answer
900 views

IIS 8.5 Request Filtering block referrer spam traffic

Recently I'm having a lot of requests that I see in google analytics from these domains (+25 others...): scanner-irvin.top scanner-viktor.top compliance-alex.top scanner-ivan.top scanner-jess.top ...
juFo's user avatar
  • 433
-1 votes
2 answers
459 views

How to filter out identical double requests on server

I've noticed that my Django application from time to time makes double database queries, instead of just one. The log file shows two similar requests at (almost) the exact same time. Example: [pid: ...
Vingtoft's user avatar
  • 1,597
0 votes
1 answer
221 views

How To Redirect Requests For a Resource That Are Not on The Server?

How to redirect requests for a resource that are not on the server ? , i have a website hosted on ubuntu 14.04 - apache 2.4 i want my website to accept only requests for files on the server and the ...
IamPublic's user avatar
0 votes
2 answers
7k views

nginx check if filename with different extension exists

If a file with ".html" extension doesn't exist I need to know if the same file exists with ".th.html" extension and make a redirect. Right now on 404 I'm doing a rewrite and if $request_filename ...
user2035693's user avatar
0 votes
1 answer
786 views

IIS Request Filtering per Site

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting ...
Daxxy's user avatar
  • 101
0 votes
1 answer
3k views

IIS Request Filtering - Why filter querystrings

In IIS7 & 8 Request Filtering feature, you can have rules to allow or deny URL and QueryString. I get why you would want to block sequences that comes in with attack vectors such as drop or ...
DomBat's user avatar
  • 149
3 votes
1 answer
11k views

Disable HTTP OPTIONS verb in IIS 7

My .NET 4.0 webapp is running on Windows Server 2008 on IIS 7.5 using an Integrated pipeline. I want to only enable the "big four" HTTP verbs. According to the documentation, this should do the trick:...
Anton Gogolev's user avatar
6 votes
1 answer
10k views

IIS Request Filtering Rule for User Agent

I'm trying to block requests from a certain bot. I've added a request filtering rule, but I know it is still hitting the site because it shows up in Google Analytics. Here is the filtering rule I ...
alexp's user avatar
  • 205
0 votes
1 answer
2k views

Tomcat6 Decompressing GZip Request

Since Tomcat has the option to compress its response to GZip. Is there a way to configure Tomcat 6 to decompress gzipped requests without putting it behind an Apache server with mod_deflate enabled, ...
Hadi Salem's user avatar
0 votes
1 answer
632 views

Why IIS is still blocking Web.config even after setting denyUrlSequences and fileExtensions?

One of the IIS sites I manage forwards all the requests to Apache. This means that any request, including requests to files such as .config, should be forwarded. <security> <...
Arseni Mourzenko's user avatar
0 votes
0 answers
156 views

Request filtering by verb and segments or url (IIS 7.5)

How can I filter POST requests to the specified URL? example.com/id123456789 where the permanent part is example.com/id example.com/id123456789/smth where the permanent part is example.com/id.../...
GraDea's user avatar
  • 101
0 votes
1 answer
6k views

Apache LimitExcept GET to IP address but deny all methods to other IPs

I'm having some trouble with getting the Order directive right in a vhost configuration in Apache. I have some IP addresses that I want to totally deny access to the entire vhost. These have been ...
batfastad's user avatar
  • 466
2 votes
1 answer
3k views

Windows Server 2008 r2 IIS: can't allow access to file extension in request filtering

I have a Windows Server 2008 r2 installation with configured FTP and IIS. If I upload through FTP two files: "test.txt" and "test.abc" and then try to access these files through HTTP, then I can ...
Mat's user avatar
  • 23
3 votes
1 answer
4k views

IIS 7 - Enabling deny url sequences with backslash

I've been trying to restrict backslashes \ in URL's via the Request filtering tool in IIS 7 by using: <configuration> <system.webServer> <security> <...
Duane's user avatar
  • 131
4 votes
2 answers
16k views

What file extensions must be allowed in request filtering when using ASP.Net MVC 3?

I have request filtering enabled and "Allow unlisted file name extensions" is set to false. When requesting any normal path, including "http://localhost" I get a 404.7 error - "The request filtering ...
Chloraphil's user avatar
3 votes
0 answers
918 views

IIS 7.5 Request Filtering - best practice rules?

Im looking for a set of best practice rules for Request Filtering similar to what UrlScan adds by default. Any suggestions or an example list of filters is much appreciated. By default IIS 7.5 only ...
Anders Vindberg's user avatar
0 votes
1 answer
1k views

Block certain filetypes and values found in the url in IIS

I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request ...
Josh's user avatar
  • 483
0 votes
1 answer
866 views

IIS Request Filtering blocks Application Request Routing

Using one box, I have an IIS server and a tracd server running. Via ARR, any request on the IIS server matching */trac/** is proxied through to the tracd server. Everything is working fine, except ...
bricelam's user avatar
  • 113
2 votes
2 answers
17k views

Request Filtering is missing from IIS Manager

I have a recently installed Web Server and i want to do some request filtering to stop spam bots requesting contacts.php files and stuff like that. The problem is that i can't find the request ...
Olaj's user avatar
  • 183
3 votes
1 answer
3k views

IIS 7.5 Request Filtering logs versus UrlScan 3.1

When IIS 7.5 Request Filtering blocks a request it seems to add an entry into the regular IIS web logs with a 404. a) Is there any way to send the detailed Request Filtering logs to a separate file? ...
Mouffette's user avatar
  • 495