0

If I use UrlScan to block common SQL Injection attempts on asp- and aspx-files, I would do something like this:

[SQLInjection] 
AppliesTo=.asp,.aspx
DenyDataSection=SQLInjectionStrings 
ScanURL=0 
ScanAllRaw=0 
ScanQueryString=1 
ScanHeaders=
[SQLInjectionStrings] 
-- 
alter 
delete 
(...)

That would catch

/default.asp?EVILACTION=DELETEDROPSLASHANDBURN
/default.aspx?EVILACTION=DELETEDROPSLASHANDBURN

But NOT

/?EVILACTION=DELETEDROPSLASHANDBURN 

How can I make an Urlscan section apply to extensionless urls too?

I tried ., leaving it blank etc - no luck.

1

Instead of leaving it blank, simply omit the AppliesTo flag entirely. If you don't have it at all, it should apply to all requests. If you specify it, but leave the value blank, it won't apply to any requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.