0

I manage a website which is being "attacked" by a very stupid bot. The bot tries the same requests all the time, it always gets a bad request response because ASP.NET detects "A potentially dangerous Request.Path value was detected from the client".

I tried to add the bot's IP to my denied ips via IIS/Web.config (ipSecurity)/.htaccess file (Helicon ape), in general it works and blocks the ip from "normal" requests. But when the bot tries to access its weird urls like 'mydomain.com/a.aspx/+[PLM=0]+GET+http://bla.bla.com' the servers throws an exception: System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (:).

I don't want my weak server to even try process any request from that IP, certainly not throwing exceptions all the time. The server is on a shared host so I don't have many options like adding some router like fortinet etc. that will block the IP at a lower level.

Any idea how can I convince my server to always ignore requests from those specific IPs, even when it tries the potentially dangerous requests? Any other suggestions how to handle this situation?

2
  • 1
    Typically you block all actions from a specific IP-address not in your webserver but instead you use a firewall for that.
    – HBruijn
    Sep 7, 2017 at 11:12
  • @HBruijn - Yes, but this specific server is on a shared web hosting service, where my access is quite limited. I have no access to firewall rules, so I'm looking for some alternative.
    – BornToCode
    Sep 7, 2017 at 12:06

1 Answer 1

1

The System.Web.HttpException: A potentially dangerous Request. is generated by ValidateInputIfRequiredByConfig() in System.Web/HttpRequest.cs. This validation is built-in and done before your current IP blocking, so the request simply never gets there. The exceptions are only proof of the validation is working and the request aren't processed any further. Don't worry.

If you really need to block the IP before any processing of the request, you need to do it at firewall level, just like HBruijn commented.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .