Re: URLScan for IIS

From: Simon Jones (simonjone@BTINTERNET.COM)
Date: 11/05/01 

Message-ID:  <KFEDJNANPBGMCJHLPHHGIEFKCAAA.simonjone@btinternet.com>
Date:         Sun, 4 Nov 2001 23:49:05 -0000
From: Simon Jones <simonjone@BTINTERNET.COM>
Subject:      Re: URLScan for IIS
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

Finally got around to having a play with URLScan.

Is it just me...or does the online documentation contradict this comment in
the ini file:

file://URLScan.ini
AllowDotInPath=1 ; if 1, allow dots that are not file
extensions

vs.

http://support.microsoft.com/support/kb/articles/q307/6/08.asp?id=307608&sd=
tech
"AllowDotInPath: Allowed values are 0 or 1. If the value is 1, URLScan
rejects any requests containing multiple instances of the period character
(.). If the value is 0, URLScan does not perform this test."

Secondly I can't get (null) extensions to be accepted. I've tried adding the
following to [AllowExtensions], but all to no avail:

./
.
.null
.(null)
.\

Is there another work-around aside from denying extensions rather than
allowing?

Relevant Pages

  • Re: URLSCAN on IIS6 config
    ... URLScan isn't rejecting it based on ".", it's rejecting the URL because you ... on IIS6 because it is not as good as the built-in support of IIS6. ... Web Service Extensions allow you control of which binaries can ...
    (microsoft.public.inetserver.iis)
  • Re: Stopping IIS from serving certain file types
    ... URLScan is the way to go for blocking files with certian file extensions. ... can configure URLScan to reject requests for .exe files to prevent Web ... below to view the article in the Microsoft Knowledge Base: ...
    (microsoft.public.inetserver.iis.security)
  • RE: URLScan
    ... that he is experiencing the download bug within urlscan that makes certain ... not related to blocked extensions. ... | knowledge of web servers and I'm not sure how I can edit the urlscan ...
    (Security-Basics)
  • URLSCAN on IIS6 config
    ... in the allow extensions settings ... >I am having some problems getting URLScan 2.5 running ... >Request will be rejected. ... Extensions listed here are commonly used on a typical ...
    (microsoft.public.inetserver.iis)
  • Re: Downloading executables from IIS
    ... All configuration of URLScan is done through the URLScan.ini file, ... If this option is set to 1, URLScan will only permit requests for files ... extensions listed in the section. ...
    (microsoft.public.inetserver.iis.security)