How to use URLScan

[Avikshit Sinha]

Hi all,

URLScan is an ISAPI filter, which allows Web site administrators to restrict the server will have to deal with the type of HTTP requests. By blocking specific HTTP requests, URLScan filter can prevent potentially harmful requests from reaching the server and cause harm. I want know how to obtain, install and configure the URLScan. Please help Thanks in advance.

[Zachary]

You can run the IISLockdown (IISLockd.exe) when you install URLScan 2.0, you can install it independently. IISLockdown installed together with URLScan 2.0: you can run the IIS Lockdown Wizard (IISLockd.exe) when you install URLScan 2.0. IISLockd.exe can be used as an Internet download at the f Microsoft Web site Check and reply.

[Big Fish]

In the case of not running IISLockdown install URLScan 2.0: To the case of not running IISLockdown install URLScan, you need to manually from the IIS Lockdown tool to extract it. First of all, you need to IISLockd.exe saved to a directory. Then, to extract the URLScan installation files from the installation directory IISLockd.exe at the command line run the following command:

iislockd.exe / q / c

URLScan 2.5 is the latest version of URLScan. If you want to install URLScan 2.5, need to install URLScan 1.0, or URLScan 2.0. All the best.

[Shen]

To configure URLScan to determine which rejected the request, you can use URLScan.ini. The file is located in the following folder:

% windir% \ system32 \ inetsrv \ urlscan

URLScan can be used as another line of defense, even before the request reaches ASP.NET is used to protect against denial of service attacks. Can be achieved by MaxAllowedContentLength、MaxUrl And MaxQueryString Attribute set restrictions to achieve this purpose. All the best.

[Steve123]

URLScan stop the DEBUG verb, which would cause the application debugging impossible. If you need to support debugging, add the DEBUG verb to the URLScan.ini in the [AllowVerbs] paragraphs. You need to restart IIS, to make the changes take effect. URLScan is an ISAPI filter in IIS process (Inetinfo.exe) operate within the IIS starts from the URLScan.ini load URLScan options. IISReset from the command prompt, run the command to restart IIS. All the best.

[Milton.J]

If the request contains the potentially harmful characters, then the URLScan will prevent such a character, for example, has been used to exploit the vulnerability in the characters, for example, can traverse the directory ".". Is not recommended in the project path contains "." Characters. If you must use the character, you need to URLScan.ini set AllowDotInPath = 1. If your Web application directory path to include the points, for example, the directory that contains the name "Asp.Net", then the URLScan will reject the request to the client returns a "404 not found" message. The other as will be URLScan rejected but should be avoided for use in the project name characters include commas (,) and the pound character (#). Best of luck.