Home / server / Questions / 1049624
Accepted
bugmagnet
Asked: 2021-01-13 18:19:20 +0800 CST

In IIS Request Filtering, is the case of the string important?

  • 772

When in the Edit Filtering Rule dialog in IIS, is the case of the string, e.g. cast( important?

Edit Filtering Rule

We're seeing SQL injection attack attempts that have the string in various combinations of upper- and lower-case, like cAsT(. Do we need to be specific? I would expect that the module doesn't expect one to think of all the possible combinations but I can't find it clearly stated as the case in any of the online re

iis request-filtering

1 Answers

  1. Best Answer

    The case of the filter strings is not important. A rule with cast should also work for cAst or CAST. This can easily be tested.

    • 0