URLSCAN on IIS6 config

From: Mike D (anonymous_at_discussions.microsoft.com)
Date: 06/04/04


Date: Fri, 4 Jun 2004 06:15:33 -0700

I am having some problems getting URLScan 2.5 running
properly on IIS6. I can't get the default doc to display
unless it is written out in the url. If I remove urlscan
from the server it is okay. The urlscan logs looks like
it is seeing a . in the url and rejecting the request
there is obviously no period in the url

Help please

Mike

http://ricweb3/default.asp output: Boo

http://ricweb3/ output: The system cannot find the file
specified.

code in default.asp
<%
response.write "Boo"
%>

----------------------------------------------------
>From urlscanlog:
[06-04-2004 - 09:08:20] Client at xxx.xxx.xxx.xxx: URL
contains extension '.', which is not specifically allowed.
Request will be rejected. Site Instance='599050834', Raw
URL='/'

------------------------------------------------
urlscan.ini settings
UseAllowExtensions=1

[AllowExtensions]
;
; Extensions listed here are commonly used on a typical
IIS server.
;
; Note that these entries are effective
if "UseAllowExtensions=1"
; is set in the [Options] section above.
;

.htm
.html
.txt
.jpg
.jpeg
.gif
.asp
------------------------------------------



Relevant Pages

  • URLScan Update
    ... I have received a lot of feedback regarding my earlier post about URLScan. ... I opened a ticket with Microsoft support. ... I also invited him to present a scenario when an IIS server ... RejectResponseUrl or allow IIS to log the request ...
    (NT-Bugtraq)
  • Re: URLScan Rejects header "transfer-encoding:"
    ... URLScan may block this type of request. ... "I really did not want to reconfigure the URLScan just to accomodate a JDK ... cause vulnerabilities on your server. ... configuration as you see fit and we provide the information to do this. ...
    (microsoft.public.inetserver.iis.security)
  • URLScan detection
    ... Product: URLScan ... URLScan can be detected on IIS servers by the way it responds to HEAD ... When a bad URL is rewritten it is changed to the GET request type. ... Server: Microsoft-IIS/5.0 ...
    (Bugtraq)
  • Re: What is the URLScan Rejection Response?
    ... You can customize the response that UrlScan sends when it rejects a request. ... page contain your own custom code to run when UrlScan rejects a request. ... RejectResponseUrl in the UrlScan.doc file. ...
    (microsoft.public.inetserver.iis.security)
  • Re: About http method trace track options in IIS4
    ... I doubt URLScan will have any noticable affect on the performance of your ... "translate:" header because it sometimes causes lots of urlscan logging you ... request. ... of allowed parts of requests reaching the server. ...
    (microsoft.public.inetserver.iis.security)