1

I have a few publicly accessible IIS servers and sites (personal and corporate), these hosts have own domains/subdomains, and all legit access to these https sites happen through domains.

Almost all HTTP app vulnerability scans from bots/rooted servers happen to the servers through IP, without valid hostname, and if there is hostname it is the default reverse DNS host, not the actual domain of the site.

Is there a way in IIS to implicitly only allow requests with proper hostname? The site root app only has bindings to the hostname, but IIS still accepts requests, and responds with 404. The best thing would be to timeout the request similar fashion as if the site doesn't have HTTP open.

I of course understand that this does not guarantee anything in security wise, the scanner can still figure out the proper hostname in many ways, but it would still filter out 90% of dummy scans.

IPS in firewall can probably do some things, but in some cases I do not have that luxury. Is there way in IIS? Redirect the http request to oblivion? (this would probably just change the error to proxy gateway http errors?)

1

I don't think there is a global setting to disallow any requests with a "valid" hostname, but you can try the following

Create a new fallback site on your IIS server, while all other sites require hostnames this site is bound to all Unassigned IP addresses without any hostnames.

So any http requests to the server without an otherwise bound hostname end up on this site which just has a simple static html page.

For this site edit the IP Address and Domain Restrictions, don't add a new entry, just go to Edit Feature Settings... :

IIS IP Restrictions

Set the default access to Deny and then the Action Type to Abort

This way no response is send to the client. You also have the options to send a 401, 403 or 404 instead, but if you want no response, use Abort

There may be other ways to accomplish this, but this should work pretty well.

0

You can create an IHttpModule that checks this.

Register the module

<system.webServer>
   <modules runAllManagedModulesForAllRequests="true">
      <add name="MyModuleToBlockRequestsWithoutSNI" type="NoSniBlockerModule" />
   </modules>
</system.webServer>

Hook the event during initialization

public class NoSniBlockerModule: IHttpModule
{
   public void Init(HttpApplication httpApplication)
   {
      // Register event handlers
      httpApplication.BeginRequest += OnApplicationBeginRequest;
   }
}

Check for SNI

private void OnApplicationBeginRequest(object sender, EventArgs e)
{
   var request = HttpContext.Current.Request;

   if (!SniPresentInRequestHeader(request))
   {
      // return the standard 400 Bad Request
      context.Response.StatusCode = 400;
      context.Response.StatusDescription = "You're missing the SNI wtf";
      context.Response.End();
      return;
   }
  
0

The design of IIS requires incoming HTTP requests to be dispatched to sites that contain the matching bindings. More details can be found in posts like this. So in IIS there is no way to implicitly only allow requests with proper hostname, but explicitly.

If "IIS still accepts requests, and responds with 404", that means some site on this server still matches those requests and you should find that site first and choose from the following,

  • Disallow this site to handle such requests by modifying its bindings.
  • Use URL Rewrite module to abort such requests or return custom errors (404 or any other).
  • Turn off this site if you don't need it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy