Home / server / Questions / 1012883
Accepted
wruckie
Asked: 2020-04-18 21:44:33 +0800 CST

IIS rewrite rule to black-hole URL's with an apostrophe

  • 772

I bought a web app that does not use special characters. In reviewing my logs, I am seeing probing by threat actors who attempt to see if my site is vulnerable to SQL injection by adding apostrophes and other char() characters that are never normally used. I trust the security of my app (mostly), but wanted to see if a rewrite rule or some other methodology would black-hole their request. My web app gives out its standard error. I am looking for rules or ideas to 1.) give the attacker as little info as possible without 2.) adding a lot of overhead to the server. There are lots of rewrite rule examples out there, but none that I have found that deal with this angle.

Simple Example of the probing: https://sub.domain.com/default.aspx?page=3500'A=0&Id=497066

security iis rewrite windows-server-2019

1 Answers

  1. Best Answer

    Something like this? It will weed out some of the nastier SQL characters.

      <system.webServer>
      <rules>
        <rule name="No SQL injection" stopProcessing="true">
          <match url=".*" />
          <conditions>
            <add input="{QUERY_STRING}" pattern="['\(\);]" />
          </conditions>
          <action type="AbortRequest" />
        </rule>
      </rules>
  </system.webServer>

    This will abort the request if any of the characters '(); appear in the query string.

    No SQL Injection rule enter image description here

    • 2