8

our site went online and of course, we started to receive loads of probing requests, like

'/blog/wp-login.php'
'/admin/admin.php'

etc.
So question is, what do you do with them?

Right now in each case 404 error is thrown and elmah sends email about it, but I think it would be better to ignore at least all php requests at all.

How to do that, that such requests would minimally load server, may be it is possible to do, that asp.net pipeline would be not involved in such requests?
Or is it better to redirect, or return empty result?

If that would require simply add IgnoreRoutes, may be someone has good set of routes, that would ignore most of the probing requests?

1
  • Very interesting question, I've just ignore 404 errors.
    – adriaanp
    Nov 14, 2011 at 7:58

3 Answers 3

10

I know that you have stated the you don't want to use the rewrite module in IIS as it 'adds additional load on IIS', but in truth, using IIS to handle these will be less intensive than passing into your application to do the same thing (even though both are extremely small resource-wise). If you want to ignore the request with the minimal amount of load on IIS and your bandwidth, I would suggest the following

<rewrite>
  <rules>
    <rule name="Fail PHP requests">
      <match url=".*"/>
      <conditions>
        <add input="{URL}" pattern="*.php*" />
      </conditions>
      <action type="AbortRequest" />
    </rule>
   </rules>
</rewrite>

This rewrite with the action type set to AbortRequest completely severs the HTTP connection and drops the request, no 404 or 403 errors returned. Taken from Learn IIS in the 'Creating an Access Block' section.

EDIT - Since there are concerns from the OP on using the rewrite module and performance, I am going to submit a second option that may still catch .php request without using the rewrite module. IIS7 and above also support Request Filtering and according to Learn IIS, Request filtering is...

The request filtering module runs at the beginning of the request processing pipeline by handling the BeginRequest event. The module evaluates the request metadata, such as headers, the query string, content length, etc, in order to determine whether the request metadata matches any existing filter. If there is a match, the module generates a 404 (File Not Found) response and then shortcuts the remainder of the IIS pipeline

To implement, add the following section to your web.config:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <fileExtensions allowUnlisted="true" >
     <add fileExtension=".php" allowed="false"/>
    </fileExtensions>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

Information from URL Rewrite vs Request Filtering and Using Request Filtering

5
  • Well, we have ~1mln regular requests a day and probing requests are less than 1%, so adding rewrite will affect performance of all requests, although it is targeted to less than 1%
    – Giedrius
    Nov 15, 2011 at 12:02
  • Not to be a jerk but, have you actually seen benchmarks where turning on rewrite would impact performance? Rewrite modules have been around in Apache since the stone age and are used essentially everywhere, the IIS implementation is basically the same. Also, this is just a basic regex which is not a taxing operation at all. Lastly, anything you can handle at the IIS level without passing to the .NET pipeline will be faster/less resource intensive as you are handling things at a lower level. I would suggest testing/research on the impacts of rewrite (I submit that it is negligible)
    – Tommy
    Nov 15, 2011 at 13:16
  • No, haven't seen any benchmarks, just this post bartwullems.blogspot.com/2011/09/… (very end of a post). It may be, that in our case its hit on performance is minimal or not noticeable. I think I will test it on Friday and have results for comparison.
    – Giedrius
    Nov 15, 2011 at 13:24
  • Interesting read - I know I was unaware of the impact to MVC and was basing my opinion simply on the IIS vs .NET pipeline. Today I learned... :)
    – Tommy
    Nov 15, 2011 at 13:32
  • Great info regarding request filtering, never seen that.
    – Giedrius
    Nov 15, 2011 at 14:09
3

This is what I have used on one of my project in web.config having a PHP as sub application:

<system.webServer>
    <rewrite>
        <rules>
            <rule name="ignorePhp" patternSyntax="Wildcard">
                <match url="*" />
                <conditions>
                    <add input="{URL}" pattern="*.php*" />
                </conditions>
                <action type="CustomResponse" statusCode="403" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

UPDATE

You may also look at this post too

2
  • as long as I don't use rewrite module in my application and having it enabled adds additional load on IIS, so would prefer another option :)
    – Giedrius
    Nov 14, 2011 at 8:29
  • You may consider using routes.IgnoreRoute. I have updated a link to ignore php requests Nov 14, 2011 at 11:01
1

You may take a look at the following article.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.