Questions tagged [request-filtering]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
0answers
983 views

Cannot remove 'Server' header with request filtering

I need to remove the 'Server' header from all http requests coming to my IIS site due to PCI DSS scanning restrictions. I am running the latest version of Windows Server 2016 using the latest version ...
0
votes
0answers
104 views

Haproxy - How to only accept requests for known URL parameters

I'm using HAProxy 1.8.17 as endpoint for https connections. Now I would like to accept requests only if the URL parameters are valid (i.e. all specified parameters are known and have valid values). ...
1
vote
0answers
381 views

IIS 8.5 Request Filtering by VERB not working

To disable TRACE/TRACK requests from IIS(Windows 2012 R2), I used the instructions from this tutorial : Verbs <verbs> | Microsoft Docs. I configured to deny OPTIONS, TRACE and TRACK requests. ...
0
votes
1answer
644 views

Does IIS Request Filtering Rules use Regex for the deny strings?

I'm trying to block user-agent X (literally, just "X") in IIS using Request Filtering Rules. We've done this in the past for other more specific user-agents without problems. However, now that the ...
0
votes
1answer
412 views

UrlScan and Request Filtering long url

Our Windows/IIS 7.5 environment is configured with UrlScan and IIS Request Filtering. We have been facing an issue with a long url. /MyWeb/TestFW/prweb/Servelt1/ZsvSk3vV8PtgJEa4_x3fiQ[[*/!MyWebApp/...
0
votes
1answer
560 views

IIS 8.5 Request Filtering block referrer spam traffic

Recently I'm having a lot of requests that I see in google analytics from these domains (+25 others...): scanner-irvin.top scanner-viktor.top compliance-alex.top scanner-ivan.top scanner-jess.top ...
-1
votes
2answers
259 views

How to filter out identical double requests on server

I've noticed that my Django application from time to time makes double database queries, instead of just one. The log file shows two similar requests at (almost) the exact same time. Example: [pid: ...
0
votes
1answer
87 views

How To Redirect Requests For a Resource That Are Not on The Server?

How to redirect requests for a resource that are not on the server ? , i have a website hosted on ubuntu 14.04 - apache 2.4 i want my website to accept only requests for files on the server and the ...
0
votes
2answers
2k views

nginx check if filename with different extension exists

If a file with ".html" extension doesn't exist I need to know if the same file exists with ".th.html" extension and make a redirect. Right now on 404 I'm doing a rewrite and if $request_filename ...
0
votes
1answer
270 views

IIS Request Filtering per Site

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting ...
0
votes
1answer
2k views

IIS Request Filtering - Why filter querystrings

In IIS7 & 8 Request Filtering feature, you can have rules to allow or deny URL and QueryString. I get why you would want to block sequences that comes in with attack vectors such as drop or ...
3
votes
1answer
9k views

Disable HTTP OPTIONS verb in IIS 7

My .NET 4.0 webapp is running on Windows Server 2008 on IIS 7.5 using an Integrated pipeline. I want to only enable the "big four" HTTP verbs. According to the documentation, this should do the trick:...
4
votes
1answer
7k views

IIS Request Filtering Rule for User Agent

I'm trying to block requests from a certain bot. I've added a request filtering rule, but I know it is still hitting the site because it shows up in Google Analytics. Here is the filtering rule I ...
0
votes
1answer
2k views

Tomcat6 Decompressing GZip Request

Since Tomcat has the option to compress its response to GZip. Is there a way to configure Tomcat 6 to decompress gzipped requests without putting it behind an Apache server with mod_deflate enabled, ...
0
votes
1answer
344 views

Why IIS is still blocking Web.config even after setting denyUrlSequences and fileExtensions?

One of the IIS sites I manage forwards all the requests to Apache. This means that any request, including requests to files such as .config, should be forwarded. <security> <...
0
votes
0answers
132 views

Request filtering by verb and segments or url (IIS 7.5)

How can I filter POST requests to the specified URL? example.com/id123456789 where the permanent part is example.com/id example.com/id123456789/smth where the permanent part is example.com/id.../...
0
votes
0answers
491 views

How to block/filter responses based on content-disposition in IIS 7.5?

I host an application which has a reporting component based on Crystal Reports and I don't have the ability to modify the application or its settings. The reports are normally rendered as HTML but ...
0
votes
1answer
5k views

Apache LimitExcept GET to IP address but deny all methods to other IPs

I'm having some trouble with getting the Order directive right in a vhost configuration in Apache. I have some IP addresses that I want to totally deny access to the entire vhost. These have been ...
2
votes
1answer
2k views

Windows Server 2008 r2 IIS: can't allow access to file extension in request filtering

I have a Windows Server 2008 r2 installation with configured FTP and IIS. If I upload through FTP two files: "test.txt" and "test.abc" and then try to access these files through HTTP, then I can ...
2
votes
1answer
2k views

IIS 7 - Enabling deny url sequences with backslash

I've been trying to restrict backslashes \ in URL's via the Request filtering tool in IIS 7 by using: <configuration> <system.webServer> <security> <...
2
votes
2answers
10k views

What file extensions must be allowed in request filtering when using ASP.Net MVC 3?

I have request filtering enabled and "Allow unlisted file name extensions" is set to false. When requesting any normal path, including "http://localhost" I get a 404.7 error - "The request filtering ...
3
votes
0answers
827 views

IIS 7.5 Request Filtering - best practice rules?

Im looking for a set of best practice rules for Request Filtering similar to what UrlScan adds by default. Any suggestions or an example list of filters is much appreciated. By default IIS 7.5 only ...
0
votes
1answer
902 views

Block certain filetypes and values found in the url in IIS

I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request ...
0
votes
1answer
415 views

IIS Request Filtering blocks Application Request Routing

Using one box, I have an IIS server and a tracd server running. Via ARR, any request on the IIS server matching */trac/** is proxied through to the tracd server. Everything is working fine, except ...
2
votes
1answer
14k views

Request Filtering is missing from IIS Manager

I have a recently installed Web Server and i want to do some request filtering to stop spam bots requesting contacts.php files and stuff like that. The problem is that i can't find the request ...
3
votes
1answer
3k views

IIS 7.5 Request Filtering logs versus UrlScan 3.1

When IIS 7.5 Request Filtering blocks a request it seems to add an entry into the regular IIS web logs with a 404. a) Is there any way to send the detailed Request Filtering logs to a separate file? ...