An Overview of IIS 7.5 feature - Request Filtering

Let’s open IIS 7.5 manager and check whether Request Filtering module is present or not under IIS section as shown below:



If it does not exist, we can install same by going “Turn on or off Windows Feature” in Control Panel and selecting same under Internet Information Services, WWW Services, Security, then Request Filtering.



Let’s select “Default Web Site”, double-click on Request Filtering and understand its settings:



We have multiple tabs to configure filtering rules for a web request.

We can use File Name Extensions tab to allow\deny a request based on its extension in the URL:



Here, we blocked requests having .aspx extension and IIS will return 404.7 for any .aspx requests.

We can add a new allow\deny rule by clicking Allow\Deny File Name Extension:



In Rules tab, we can create our own custom filtering rules,



Here, I created a rule “Test rule” to scan URL, query string and apply it to .aspx requests and deny those having DECLARE or BEGIN keywords in it.

In Hidden Segments tab, we can specify URLs that cannot be browsed:



Here, I configured a rule to block URLs that request to MyCode folder.

In URL tab, we can configure a “allow URL\Deny sequence”:



Here, I configured a rule to deny sequence “~” in its URL.

In HTTP Verbs, we can configure a request based on its verbs:



This setting will block any request with PUT as its HTTP verb.

In Headers tab, we can add headers and set maximum size of it:



Here, I configured content-size header with its size limit as 100 bytes.

In Query String tab, we can allow\deny request based on query string:



It will block any request having username as query string in its URL.
By looking into sub status code of 404 in IIS\ FREB logs, we can easily identify by which filtering rule request is blocked: