URLScan detection

From: Stephen Cope (mail_at_nonsense.kimihia.org.nz)
Date: 05/31/03

  • Next message: Bosen: "iisCart2000 Administration Security Leak" 
    Date: Sat, 31 May 2003 13:58:58 +1200
To: bugtraq@securityfocus.com

    Product: URLScan (for IIS)
    Vendor : Microsoft
    Date : Monday 27 May 2002

    URLScan is a popular "Security Tool" used to filter out malicious
    looking URLs. It has a variety of filters, including blocking requests
    with excess escaped characters or for files with given extensions, eg,
    .exe.

    http://www.microsoft.com/technet/security/tools/tools/urlscan.asp

    URLScan can be detected on IIS servers by the way it responds to HEAD
    requests.

    When a bad URL is rewritten it is changed to the GET request type.

    Here's an example in action:

    First an innocent request:

    HEAD /OMG HTTP/1.1
    Host: iis
    Connection: close

    Response:

    HTTP/1.1 404 Object Not Found
    Server: Microsoft-IIS/5.0
    Date: Tue, 28 May 2002 04:30:42 GMT
    Content-Length: 4040
    Content-Type: text/html

    Now one that will be blocked by URLScan. Note the .exe extension. This
    is a common extension to block with URLScan's out-of-the-box settings:

    HEAD /OMG.exe HTTP/1.1
    Host: iis
    Connection: close

    Response:

    HTTP/1.1 404 Object Not Found
    Server: Microsoft-IIS/5.0
    Date: Tue, 28 May 2002 04:32:15 GMT
    Connection: close
    Content-Length: 4040
    Content-Type: text/html

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
    <html dir=ltr>
    [huge page of HTML snipped]

    So when URLScan zapped the request it displayed the content of the
    document. It rewrote the HEAD request to a GET request. This does
    violate RFC 2616 section 9.4, which states:

        The HEAD method is identical to GET except that the server MUST NOT
        return a message-body in the response.

    The version of URLSCAN.DLL in use is 6.0.3547.0

    Now you can tell if the server admin is being proactive in security or
    whether they are an easy target.

    Vendor reply, explaining this behaviour is as follows:

    Hi Stephen:

    I got some feedback from the developers of this tools and what you are
    saying is true. When UrlScan rejects a request, it changes the inbound
    data from whatever is was to a known GET request for the reject page.
    You can change this behavior by setting "UseFastPathReject=1".

    This is by design to ensure that no non-GET requests can reach the
    reject URL. The behavior described below is a side effect of this.

    Please let me know if you have any further questions or feedback. I
    would be happy to address them.

    Thanks again for your inquiry.

    Kind regards,

    --- end quote

    Thank you to my employer at the time, Gorilla Technology
    www.gorilla.co.nz 

    -- 
Stephen Cope - http://sdc.org.nz/
  • Next message: Bosen: "iisCart2000 Administration Security Leak"

    Relevant Pages

    • Re: Page Cannot Be Displayed Errors
      ... In WFetch, for Advanced Request, change to "Add Headers" and write: ... > directly on the web server, ... >>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
      (microsoft.public.inetserver.iis)
    • Re: Performance question (IIS 6)
      ... The delay on the first request is due to interaction between IIS process ... You can do this yourself by making a request to the necessary application ... Turn off all the application pool recycling parameters except maybe the ... until you reboot the server. ...
      (microsoft.public.inetserver.iis)
    • Re: About http method trace track options in IIS4
      ... I doubt URLScan will have any noticable affect on the performance of your ... "translate:" header because it sometimes causes lots of urlscan logging you ... request. ... of allowed parts of requests reaching the server. ...
      (microsoft.public.inetserver.iis.security)
    • Re: Page Cannot Be Displayed Errors
      ... not IIS, but something else. ... >>> directly on the web server, ... >>>>> I have done some additional checking in the logs. ... >>>>> either the request isn't even getting to IIS at this point, ...
      (microsoft.public.inetserver.iis)
    • Re: URLscan problem
      ... I did indeed restart the IIS server after ... I took a look at the URLscan log files and found my ... >URLscan seems to be causing a problem with public folder ...
      (microsoft.public.inetserver.iis.security)