Questions tagged [request-filtering]
The request-filtering tag has no usage guidance.
32
questions
1
vote
1
answer
101
views
rewrite based on script in URL
Using Apache 2.2.x -- my usual approach to blocking script kiddies from looking for various scripts on the server is to use dynamically created 'deny from' lists with the offending ip's. Works, but is ...
- 141
0
votes
1
answer
220
views
allow specific files and block the rest
i tryied to allow specific files in iis 10
MED.exe StartMed.exe
and block exe extention with request filtering
request filtering
but i got this error
error message
1
vote
0
answers
144
views
How to block those requests?
One of my website seems to be being under attack.
I am getting requests, as shown below, from several IPs addresses.
Is there a way to block them?
- 123
1
vote
1
answer
289
views
What is the order of the processing of modules in IIS?
We have an URL Rewrite rule and a Request Filter. Which one evaluates first?
- 236
2
votes
1
answer
137
views
In IIS Request Filtering, is the case of the string important?
When in the Edit Filtering Rule dialog in IIS, is the case of the string, e.g. cast( important?
We're seeing SQL injection attack attempts that have the string in various combinations of upper- and ...
- 236
0
votes
1
answer
438
views
How to completely disable request filtering in IIS
My issue is relating to large file uploads (>2 GB) that are getting filtered by IIS request filtering.
So how can I completely disable IIS request filtering?
- 469
0
votes
1
answer
390
views
Can IIS 8 Request Filtering inspect/filter form posts?
I have a server which is constantly being attacked by malicious scripts (from various geo-locations, so IP filtering isnt effective)
Fortunately, I have determined some of the form post values which ...
- 309
1
vote
0
answers
42
views
How do I prohibit access to a file type except for a few files
Is there a way to configure IIS to prohibit serving a certain type of files, but still allow it for a specific number of files? I need to disallow access to .property files, but there are a few of ...
- 249
6
votes
1
answer
14k
views
Cannot remove 'Server' header with request filtering
I need to remove the 'Server' header from all http requests coming to my IIS site due to PCI DSS scanning restrictions. I am running the latest version of Windows Server 2016 using the latest version ...
- 315
1
vote
0
answers
760
views
IIS 8.5 Request Filtering by VERB not working
To disable TRACE/TRACK requests from IIS(Windows 2012 R2), I used the instructions from this tutorial : Verbs <verbs> | Microsoft Docs.
I configured to deny OPTIONS, TRACE and TRACK requests.
...
- 151
1
vote
1
answer
2k
views
Does IIS Request Filtering Rules use Regex for the deny strings?
I'm trying to block user-agent X (literally, just "X") in IIS using Request Filtering Rules. We've done this in the past for other more specific user-agents without problems.
However, now that the ...
- 123
0
votes
1
answer
727
views
UrlScan and Request Filtering long url
Our Windows/IIS 7.5 environment is configured with UrlScan and IIS Request Filtering. We have been facing an issue with a long url.
/MyWeb/TestFW/prweb/Servelt1/ZsvSk3vV8PtgJEa4_x3fiQ[[*/!MyWebApp/...
- 1
0
votes
1
answer
863
views
IIS 8.5 Request Filtering block referrer spam traffic
Recently I'm having a lot of requests that I see in google analytics from these domains (+25 others...):
scanner-irvin.top
scanner-viktor.top
compliance-alex.top
scanner-ivan.top
scanner-jess.top
...
- 423
-1
votes
2
answers
452
views
How to filter out identical double requests on server
I've noticed that my Django application from time to time makes double database queries, instead of just one. The log file shows two similar requests at (almost) the exact same time.
Example:
[pid: ...
- 1,577
0
votes
1
answer
215
views
How To Redirect Requests For a Resource That Are Not on The Server?
How to redirect requests for a resource that are not on the server ? ,
i have a website hosted on ubuntu 14.04 - apache 2.4 i want my website to accept only requests for files on the server and the ...
- 45
0
votes
2
answers
7k
views
nginx check if filename with different extension exists
If a file with ".html" extension doesn't exist I need to know if the same file exists with ".th.html" extension and make a redirect.
Right now on 404 I'm doing a rewrite and if $request_filename ...
- 101
0
votes
1
answer
751
views
IIS Request Filtering per Site
I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis.
I believe that my website is inheriting ...
- 101
0
votes
1
answer
3k
views
IIS Request Filtering - Why filter querystrings
In IIS7 & 8 Request Filtering feature, you can have rules to allow or deny URL and QueryString.
I get why you would want to block sequences that comes in with attack vectors such as drop or ...
- 149
3
votes
1
answer
11k
views
Disable HTTP OPTIONS verb in IIS 7
My .NET 4.0 webapp is running on Windows Server 2008 on IIS 7.5 using an Integrated pipeline.
I want to only enable the "big four" HTTP verbs. According to the documentation, this should do the trick:...
- 1,582
6
votes
1
answer
10k
views
IIS Request Filtering Rule for User Agent
I'm trying to block requests from a certain bot. I've added a request filtering rule, but I know it is still hitting the site because it shows up in Google Analytics. Here is the filtering rule I ...
- 205
0
votes
1
answer
2k
views
Tomcat6 Decompressing GZip Request
Since Tomcat has the option to compress its response to GZip.
Is there a way to configure Tomcat 6 to decompress gzipped requests without putting it behind an Apache server with mod_deflate enabled, ...
- 303
0
votes
1
answer
609
views
Why IIS is still blocking Web.config even after setting denyUrlSequences and fileExtensions?
One of the IIS sites I manage forwards all the requests to Apache. This means that any request, including requests to files such as .config, should be forwarded.
<security>
<...
- 2,275
0
votes
0
answers
153
views
Request filtering by verb and segments or url (IIS 7.5)
How can I filter POST requests to the specified URL?
example.com/id123456789
where the permanent part is example.com/id
example.com/id123456789/smth
where the permanent part is example.com/id.../...
- 101
0
votes
1
answer
6k
views
Apache LimitExcept GET to IP address but deny all methods to other IPs
I'm having some trouble with getting the Order directive right in a vhost configuration in Apache.
I have some IP addresses that I want to totally deny access to the entire vhost. These have been ...
- 456
2
votes
1
answer
3k
views
Windows Server 2008 r2 IIS: can't allow access to file extension in request filtering
I have a Windows Server 2008 r2 installation with configured FTP and IIS.
If I upload through FTP two files: "test.txt" and "test.abc" and then try to access these files through HTTP, then I can ...
- 23
3
votes
1
answer
4k
views
IIS 7 - Enabling deny url sequences with backslash
I've been trying to restrict backslashes \ in URL's via the Request filtering tool in IIS 7 by using:
<configuration>
<system.webServer>
<security>
<...
- 131
4
votes
2
answers
15k
views
What file extensions must be allowed in request filtering when using ASP.Net MVC 3?
I have request filtering enabled and "Allow unlisted file name extensions" is set to false. When requesting any normal path, including "http://localhost" I get a 404.7 error - "The request filtering ...
- 251
3
votes
0
answers
913
views
IIS 7.5 Request Filtering - best practice rules?
Im looking for a set of best practice rules for Request Filtering similar to what UrlScan adds by default.
Any suggestions or an example list of filters is much appreciated. By default IIS 7.5 only ...
- 161
0
votes
1
answer
1k
views
Block certain filetypes and values found in the url in IIS
I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request ...
- 483
0
votes
1
answer
840
views
IIS Request Filtering blocks Application Request Routing
Using one box, I have an IIS server and a tracd server running. Via ARR, any request on the IIS server matching */trac/** is proxied through to the tracd server.
Everything is working fine, except ...
- 113
2
votes
2
answers
17k
views
Request Filtering is missing from IIS Manager
I have a recently installed Web Server and i want to do some request filtering to stop spam bots requesting contacts.php files and stuff like that. The problem is that i can't find the request ...
- 183
3
votes
1
answer
3k
views
IIS 7.5 Request Filtering logs versus UrlScan 3.1
When IIS 7.5 Request Filtering blocks a request it seems to add an entry into the regular IIS web logs with a 404.
a) Is there any way to send the detailed Request Filtering logs to a separate file? ...
- 495