Home/ Questions/Q 6726803
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T09:58:15+00:00

My little ASP.NET MVC application is getting quite a few requests to bogus setup.php

  • 0

My little ASP.NET MVC application is getting quite a few requests to bogus “setup.php” pages (easily 200+ per week). I’m guessing this is some bot attempting to find vulnerable sites on the web to hack. It’s not a huge issue, but it does tend to fill up my error logs with junk and can make it harder to find real issues that need to be fixed.

What I’d like to do is create a route to handle all .php requests (and potentially other clearly bogus extensions) and handle them in some way. What would be fantastic would be to immediately abort the request so that my application isn’t wasting time/bandwidth on creating and sending a response (even if it’s just a 404). Also, assuming these are malicious requests, it would be great to make their server sit and wait for a timeout instead of getting an immediate response and quickly moving on to try someone else’s servers 🙂

So, I guess this is a 2 part question.

  1. Is it possible to simply stop processing a request in ASP.NET/MVC without sending a response

  2. Is there a better solution to this issue?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you’re using IIS7 checkout http://learn.iis.net/page.aspx/499/request-blocking—rule-template/

    This can be specified in your web.config as well

    <system.webServer>
    <rewrite>
        <rules>
            <rule name="RequestBlockingRule1" patternSyntax="Wildcard">
                <match url="*" />
                <conditions>
                    <add input="{URL}" pattern="*.php*" />
                </conditions>
                <action type="CustomResponse" statusCode="403" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>
    • 0