Re: Disable trace and track verbs

anonymous_at_discussions.microsoft.com
Date: 02/11/04


Date: Tue, 10 Feb 2004 22:06:49 -0800

no, it is actually a reply from the server OK. But on
the other hand I can look at URLscan logs and see the DLL
loading and rejecting certain other URL sequences.

DO you recommend a procedure to test URLScan.

P.S. we are running IIS 6.
>-----Original Message-----
>Are the responses 200 or 404?
>Are you using a RejectResponseUrl that points to content?
>
>--
>//David
>IIS
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>//
>"Rob" <anonymous@discussions.microsoft.com> wrote in
message
>news:e61f01c3f030$dfc98bd0$a601280a@phx.gbl...
>I have installed URLScan and i am still get a respond on
>my web site to trace and track commands. I thought
>URLScan 2.5 woul take care of it. I have the AllowVerbs
>set to 1 and then the very TRACE and track are not in
>that section.
>
>Any ideas?
>
>
>.
>



Relevant Pages

  • Re: Disable trace and track verbs
    ... I understand what u are saying, but URLscan will not ... intercept that command yet as IIS will still respond to ... an OPTIONS and TRACE command even with it disabled. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Disable trace and track verbs
    ... OPTIONS, TRACE, GET, HEAD, POST\r\n ... by default option is not allow in urlscan [allowverbs] section. ... >>my web site to trace and track commands. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Disable TRACE IIS 6
    ... I have installed urlscan and allowed only GET, HEAD, POST verbs ... URLScan will reject PUT with 404 if it is running so it looks like ... TRACE has special code in IIS that skips over URLScan's attempt to ... Consider the security setting of Known Extensions -- IIS returns 404 ...
    (microsoft.public.inetserver.iis.security)
  • Re: Disabling HTTP Trace Without using URL Scan
    ... you can install UrlScan 2.5 without the lockdown tool. ... If you have a hard core goal of disabling TRACE without any additional ...
    (microsoft.public.inetserver.iis.security)
  • Re: Disable trace and track verbs
    ... His latest post shows it was another urlscan that hosted in ISA... ... for IIS 6.0, both TRACE and TRACK are logged by IIS. ... >> an OPTIONS and TRACE command even with it disabled. ...
    (microsoft.public.inetserver.iis.security)