IFilter to filter out mischievous requests

[Jan Limpens]

I was thinking about making a filter for filtering out all thos stupid robot hacking requests we are getting.

1) does this already exist somewhere?
2) Is this a good idea at all, or should this happen at another layer?
3) If I need to impl this - are there good libraries around to help me identify xss, sql injection, etc... requests?

Thanks!

--
Jan

[Mauricio Scheffer]

I'm not a security expert, but IMHO an IFilter could only be the
*last* line of defense. Before the request really reaches your app you
could have an apache+mod_security proxy, and then some ISAPI filters
to blacklist some user-agents ( http://www.tacticaltechnique.com/bots/blacklisting-via-iirf/
) or reject certain URL patterns (
http://kartones.net/blogs/kartones/archive/2008/05/27/iirf-a-decent-url-rewriter-isapi-filter.aspx
).

Also take a look at AQTRONIX WebKnight, haven't tried it but looks
good ( http://www.aqtronix.com/?PageID=99 )

BTW your app should be by itself resistant to sql injection attacks.

It would also be cool to have something like asp.net mvc's
AntiForgeryToken (
http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/
) in MonoRail.

Cheers,
Mauricio

[Jan Limpens]

On Mon, Feb 8, 2010 at 3:31 PM, Mauricio Scheffer <mauricio...@gmail.com> wrote:

 

BTW your app should be by itself resistant to sql injection attacks.

It is, just these attacks generate a considerable about of peak load sometimes and if i could just filter them out with some matching, I could avoid that altogether.

Thanks for the list! I'll investigate into this...

--
Jan

[John Simons]

Jan, if you can figure out the URL pattern that the robots use, you should be able to configure route patterns to handle the robots.

Cheers John

--
You received this message because you are subscribed to the Google Groups "Castle Project Users" group.
To post to this group, send email to castle-pro...@googlegroups.com.
To unsubscribe from this group, send email to castle-project-u...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/castle-project-users?hl=en.

---

Yahoo!7: Catch-up on your favourite Channel 7 TV shows easily, legally, and for free at PLUS7. Check it out.

[Jan Limpens]

there are so many different robots, all of them using all possible php exploits on my mr pages, it is almost amusing to see, how easy it must be to hack a lot of sites out there. if there is a pattern i'd rather have some security minded folk taking care of this than me trying to figure that out...
but you are right, routes could be an option. one could persist and the redirect non successfull controller/action combos which then would not even touch a more resourceful controller/action.

--
Jan