urlscan نرم افزار تولیدی مایکروسافت برای کنترل ادرس ها و درخواستهای ارسال شده به HTTP میباشد.(شبیه به modesecurity در apache کار میکند.)
بعد از دانلود و نصب نرم افزار تنظیمات دلخواه در فایل c:\windows\system32\inetsrv\urlscan\urlscan.ini انجام میشود.
تنظیمات پیشنهادی در زیر امده است.
بعد از دانلود و نصب نرم افزار تنظیمات دلخواه در فایل c:\windows\system32\inetsrv\urlscan\urlscan.ini انجام میشود.
تنظیمات پیشنهادی در زیر امده است.
[options]
UseAllowVerbs=1 ; If 1, use [AllowVerbs] section, else use the ; [DenyVerbs] section. UseAllowExtensions=0 ; If 1, use [AllowExtensions] section, else use ; the [DenyExtensions] section. NormalizeUrlBeforeScan=1 ; If 1, canonicalize URL before processing. VerifyNormalization=1 ; If 1, canonicalize URL twice and reject request ; if a change occurs. AllowHighBitCharacters=1 ; If 1, allow high bit (ie. UTF8 or MBCS) ; characters in URL. AllowDotInPath=1 ; If 1, allow dots that are not file extensions. RemoveServerHeader=1 ; If 1, remove the 'Server' header from response. EnableLogging=1 ; If 1, log UrlScan activity. PerProcessLogging=0 ; If 1, the UrlScan.log filename will contain a PID ; (ie. UrlScan.123.log). AllowLateScanning=1 ; If 1, then UrlScan will load as a low priority ; filter. PerDayLogging=1 ; If 1, UrlScan will produce a new log each day with ; activity in the form 'UrlScan.010101.log'. UseFastPathReject=0 ; If 1, then UrlScan will not use the ; RejectResponseUrl or allow IIS to log the request. LogLongUrls=1 ; If 1, then up to 128K per request can be logged. ; If 0, then only 1k is allowed. ; ; If UseFastPathReject is 0, then UrlScan will send ; rejected requests to the URL specified by RejectResponseUrl. ; If not specified, '/' will be used. ; RejectResponseUrl=block.htm ; ; LoggingDirectory can be used to specify the directory where the ; log file will be created. This value should be the absolute path ; (ie. c:\some\path). If not specified, then UrlScan will create ; the log in the same directory where the UrlScan.dll file is located. ; LoggingDirectory=d:\urlscanlog ; ; If RemoveServerHeader is 0, then AlternateServerName can be ; used to specify a replacement for IIS's built in 'Server' header ; AlternateServerName=Karen [RequestLimits] ; ; The entries in this section impose limits on the length ; of allowed parts of requests reaching the server. ; ; It is possible to impose a limit on the length of the ; value of a specific request header by prepending "Max-" to the ; name of the header. For example, the following entry would ; impose a limit of 100 bytes to the value of the ; 'Content-Type' header: ; ; Max-Content-Type=100 ; ; To list a header and not specify a maximum value, use 0 ; (ie. 'Max-User-Agent=0'). Also, any headers not listed ; in this section will not be checked for length limits. ; ; There are 3 special case limits: ; ; - MaxAllowedContentLength specifies the maximum allowed ; numeric value of the Content-Length request header. For ; example, setting this to 1000 would cause any request ; with a content length that exceeds 1000 to be rejected. ; The default is 30000000. ; ; - MaxUrl specifies the maximum length of the request URL, ; not including the query string. The default is 260 (which ; is equivalent to MAX_PATH). ; ; - MaxQueryString specifies the maximum length of the query ; string. The default is 2048. ; MaxAllowedContentLength=30000000 MaxUrl=260 MaxQueryString=2048 [AllowVerbs] ; ; The verbs (aka HTTP methods) listed here are those commonly ; processed by a typical IIS server. ; ; Note that these entries are effective if "UseAllowVerbs=1" ; is set in the [Options] section above. ; GET HEAD POST OPTIONS [DenyVerbs] ; ; The verbs (aka HTTP methods) listed here are used for publishing ; content to an IIS server via WebDAV. ; ; Note that these entries are effective if "UseAllowVerbs=0" ; is set in the [Options] section above. ; PROPFIND PROPPATCH MKCOL DELETE PUT COPY MOVE LOCK UNLOCK OPTIONS SEARCH [DenyHeaders] ; ; The following request headers alter processing of a ; request by causing the server to process the request ; as if it were intended to be a WebDAV request, instead ; of a request to retrieve a resource. ; If: Lock-Token: [AllowExtensions] ; ; Extensions listed here are commonly used on a typical IIS server. ; ; Note that these entries are effective if "UseAllowExtensions=1" ; is set in the [Options] section above. ; .htm .html .txt .jpg .jpeg .gif .aspx .asp .axd .ashx [DenyExtensions] ; ; Extensions listed here either run code directly on the server, ; are processed as scripts, or are static files that are ; generally not intended to be served out. ; ; Note that these entries are effective if "UseAllowExtensions=0" ; is set in the [Options] section above. ; ; Also note that ASP scripts are denied with the below ; settings. If you wish to enable ASP, remove the ; following extensions from this list: ; .asp ; .cer ; .cdx ; .asa ; ; Deny ASP requests ;.asp ;.cer ;.cdx ;.asa ; Deny executables that could run on the server .exe .bat .cmd .com ; Deny infrequently used scripts .htw ; Maps to webhits.dll, part of Index Server .ida ; Maps to idq.dll, part of Index Server .idq ; Maps to idq.dll, part of Index Server .htr ; Maps to ism.dll, a legacy administrative tool .idc ; Maps to httpodbc.dll, a legacy database access tool .shtm ; Maps to ssinc.dll, for Server Side Includes .shtml ; Maps to ssinc.dll, for Server Side Includes .stm ; Maps to ssinc.dll, for Server Side Includes .printer ; Maps to msw3prt.dll, for Internet Printing Services ; Deny various static files .ini ; Configuration files .log ; Log files .pol ; Policy files .dat ; Configuration files .tmp ; deny temporary file .sav ; deny backup registry files .htw ; deny Index Server hit-highlighting .evt ; deny Event Viewer logs .btr ; deny FrontPage dependency files ;dot net deny files .asax .ascx .config .cs .csproj .dll .licx .pdb .resx .resources .vb .vbproj .vsdisco .webinfo .xsd .xsx [DenyUrlSequences] .. ; deny directory traversals ./ ; deny trailing dot on a directory name \ ; deny backslashes in URL : ; deny alternate stream access % ; deny escaping after normalization & ; deny multiple CGI processes to run on a single request /fpdb/ ; deny browse access to FrontPage database files /_private ; deny FrontPage private files (often form results) /_vti_pvt ; deny FrontPage Web configuration files /_vti_cnf ; deny FrontPage metadata files /_vti_txt ; deny FrontPage text catalogs and indices /_vti_log ; deny FrontPage authoring log files |
ادرس های مرجع مایکروسافت:
http://www.microsoft.com/technet/security/tools/urlscan.mspx
http://support.microsoft.com/kb/307608
http://support.microsoft.com/kb/326444/EN-US/
http://support.microsoft.com/kb/309394/EN-US/
http://support.microsoft.com/kb/318290/EN-US/
http://support.microsoft.com/kb/815155/EN-US/
http://support.microsoft.com/kb/312376/
http://support.microsoft.com/kb/307608
http://support.microsoft.com/kb/326444/EN-US/
http://support.microsoft.com/kb/309394/EN-US/
http://support.microsoft.com/kb/318290/EN-US/
http://support.microsoft.com/kb/815155/EN-US/
http://support.microsoft.com/kb/312376/
