0

I manage a website which is being "attacked" by a very stupid bot. The bot tries the same requests all the time, it always gets a bad request response because ASP.NET detects "A potentially dangerous Request.Path value was detected from the client".

I tried to add the bot's IP to my denied ips via IIS/Web.config (ipSecurity)/.htaccess file (Helicon ape), in general it works and blocks the ip from "normal" requests. But when the bot tries to access its weird urls like 'mydomain.com/a.aspx/+[PLM=0]+GET+http://bla.bla.com' the servers throws an exception: System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (:).

I don't want my weak server to even try process any request from that IP, certainly not throwing exceptions all the time. The server is on a shared host so I don't have many options like adding some router like fortinet etc. that will block the IP at a lower level.

Any idea how can I convince my server to always ignore requests from those specific IPs, even when it tries the potentially dangerous requests? Any other suggestions how to handle this situation?

  • 1
    Typically you block all actions from a specific IP-address not in your webserver but instead you use a firewall for that. – HBruijn Sep 7 '17 at 11:12
  • @HBruijn - Yes, but this specific server is on a shared web hosting service, where my access is quite limited. I have no access to firewall rules, so I'm looking for some alternative. – BornToCode Sep 7 '17 at 12:06
1

The System.Web.HttpException: A potentially dangerous Request. is generated by ValidateInputIfRequiredByConfig() in System.Web/HttpRequest.cs. This validation is built-in and done before your current IP blocking, so the request simply never gets there. The exceptions are only proof of the validation is working and the request aren't processed any further. Don't worry.

If you really need to block the IP before any processing of the request, you need to do it at firewall level, just like HBruijn commented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.