Questions tagged [request-filtering]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
66 views

Configure IIS to block all files of type except for specific files

I want to block our websites from serving any JSON or XML files except for a few specific files. So far my approach has been to use the Request Filtering feature to block all unlisted file name ...
0
votes
1answer
28 views

Can IIS 8 Request Filtering inspect/filter form posts?

I have a server which is constantly being attacked by malicious scripts (from various geo-locations, so IP filtering isnt effective) Fortunately, I have determined some of the form post values which ...
1
vote
0answers
26 views

How do I prohibit access to a file type except for a few files

Is there a way to configure IIS to prohibit serving a certain type of files, but still allow it for a specific number of files? I need to disallow access to .property files, but there are a few of ...
3
votes
0answers
3k views

Cannot remove 'Server' header with request filtering

I need to remove the 'Server' header from all http requests coming to my IIS site due to PCI DSS scanning restrictions. I am running the latest version of Windows Server 2016 using the latest version ...
1
vote
0answers
491 views

IIS 8.5 Request Filtering by VERB not working

To disable TRACE/TRACK requests from IIS(Windows 2012 R2), I used the instructions from this tutorial : Verbs <verbs> | Microsoft Docs. I configured to deny OPTIONS, TRACE and TRACK requests. ...
1
vote
1answer
885 views

Does IIS Request Filtering Rules use Regex for the deny strings?

I'm trying to block user-agent X (literally, just "X") in IIS using Request Filtering Rules. We've done this in the past for other more specific user-agents without problems. However, now that the ...
0
votes
1answer
535 views

UrlScan and Request Filtering long url

Our Windows/IIS 7.5 environment is configured with UrlScan and IIS Request Filtering. We have been facing an issue with a long url. /MyWeb/TestFW/prweb/Servelt1/ZsvSk3vV8PtgJEa4_x3fiQ[[*/!MyWebApp/...
0
votes
1answer
631 views

IIS 8.5 Request Filtering block referrer spam traffic

Recently I'm having a lot of requests that I see in google analytics from these domains (+25 others...): scanner-irvin.top scanner-viktor.top compliance-alex.top scanner-ivan.top scanner-jess.top ...
-1
votes
2answers
310 views

How to filter out identical double requests on server

I've noticed that my Django application from time to time makes double database queries, instead of just one. The log file shows two similar requests at (almost) the exact same time. Example: [pid: ...
0
votes
1answer
97 views

How To Redirect Requests For a Resource That Are Not on The Server?

How to redirect requests for a resource that are not on the server ? , i have a website hosted on ubuntu 14.04 - apache 2.4 i want my website to accept only requests for files on the server and the ...
0
votes
2answers
4k views

nginx check if filename with different extension exists

If a file with ".html" extension doesn't exist I need to know if the same file exists with ".th.html" extension and make a redirect. Right now on 404 I'm doing a rewrite and if $request_filename ...
0
votes
1answer
375 views

IIS Request Filtering per Site

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting ...
0
votes
1answer
2k views

IIS Request Filtering - Why filter querystrings

In IIS7 & 8 Request Filtering feature, you can have rules to allow or deny URL and QueryString. I get why you would want to block sequences that comes in with attack vectors such as drop or ...
3
votes
1answer
10k views

Disable HTTP OPTIONS verb in IIS 7

My .NET 4.0 webapp is running on Windows Server 2008 on IIS 7.5 using an Integrated pipeline. I want to only enable the "big four" HTTP verbs. According to the documentation, this should do the trick:...
6
votes
1answer
8k views

IIS Request Filtering Rule for User Agent

I'm trying to block requests from a certain bot. I've added a request filtering rule, but I know it is still hitting the site because it shows up in Google Analytics. Here is the filtering rule I ...
0
votes
1answer
2k views

Tomcat6 Decompressing GZip Request

Since Tomcat has the option to compress its response to GZip. Is there a way to configure Tomcat 6 to decompress gzipped requests without putting it behind an Apache server with mod_deflate enabled, ...
0
votes
1answer
368 views

Why IIS is still blocking Web.config even after setting denyUrlSequences and fileExtensions?

One of the IIS sites I manage forwards all the requests to Apache. This means that any request, including requests to files such as .config, should be forwarded. <security> <...
0
votes
0answers
136 views

Request filtering by verb and segments or url (IIS 7.5)

How can I filter POST requests to the specified URL? example.com/id123456789 where the permanent part is example.com/id example.com/id123456789/smth where the permanent part is example.com/id.../...
0
votes
0answers
506 views

How to block/filter responses based on content-disposition in IIS 7.5?

I host an application which has a reporting component based on Crystal Reports and I don't have the ability to modify the application or its settings. The reports are normally rendered as HTML but ...
0
votes
1answer
6k views

Apache LimitExcept GET to IP address but deny all methods to other IPs

I'm having some trouble with getting the Order directive right in a vhost configuration in Apache. I have some IP addresses that I want to totally deny access to the entire vhost. These have been ...
2
votes
1answer
2k views

Windows Server 2008 r2 IIS: can't allow access to file extension in request filtering

I have a Windows Server 2008 r2 installation with configured FTP and IIS. If I upload through FTP two files: "test.txt" and "test.abc" and then try to access these files through HTTP, then I can ...
3
votes
1answer
3k views

IIS 7 - Enabling deny url sequences with backslash

I've been trying to restrict backslashes \ in URL's via the Request filtering tool in IIS 7 by using: <configuration> <system.webServer> <security> <...
3
votes
2answers
12k views

What file extensions must be allowed in request filtering when using ASP.Net MVC 3?

I have request filtering enabled and "Allow unlisted file name extensions" is set to false. When requesting any normal path, including "http://localhost" I get a 404.7 error - "The request filtering ...
3
votes
0answers
869 views

IIS 7.5 Request Filtering - best practice rules?

Im looking for a set of best practice rules for Request Filtering similar to what UrlScan adds by default. Any suggestions or an example list of filters is much appreciated. By default IIS 7.5 only ...
0
votes
1answer
921 views

Block certain filetypes and values found in the url in IIS

I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request ...
0
votes
1answer
427 views

IIS Request Filtering blocks Application Request Routing

Using one box, I have an IIS server and a tracd server running. Via ARR, any request on the IIS server matching */trac/** is proxied through to the tracd server. Everything is working fine, except ...
2
votes
1answer
15k views

Request Filtering is missing from IIS Manager

I have a recently installed Web Server and i want to do some request filtering to stop spam bots requesting contacts.php files and stuff like that. The problem is that i can't find the request ...
3
votes
1answer
3k views

IIS 7.5 Request Filtering logs versus UrlScan 3.1

When IIS 7.5 Request Filtering blocks a request it seems to add an entry into the regular IIS web logs with a 404. a) Is there any way to send the detailed Request Filtering logs to a separate file? ...