Question

In our .NET app we get requests for files like _vti_bin/owssvr.dll (which can be hack attempts). I’d like to handle them by doing something like adding the following code to Application_BeginRequest:

    if (HttpContext.Current.Request.Url.ToString().Contains("_vti_bin/owssvr.dll"))
    {
        HttpContext.Current.Response.Clear();
        HttpContext.Current.Response.End();
    }

But I figure this is an unscalable, ineffective way of handling the problem. Any better ideas?

Answer 1

Isn’t this the sort of thing URLScan is for?

URLScan is IIS extension from Microsoft that automatically rejects malicious requests before letting IIS handle them. It rejects vti_bin requests and many other attacks.