F5 LTM/ASM , I-rule to ignore query string to prevent DDOS attack.

Question

Hello guys,My environment : F5 ltm, ASM learning mode.Webapp: Public facing site with many pages with&nbsp; few search pages and filtering pages.I see many people are hitting the site with unknow query string and trying to flood the site.http://app/a/?loc=samhttp://app/b/?page=page1http://app/b2/?page=page2Is there a way to remove all the query string parameters and redirect to the url with out query string like url redirect module.I want to exclude some pages that allow content filtering like using query string .Do we want to use Irule to achieve this or ASM/LTM module has a better solution. &nbsp;I rules sure I can achieve this, but not sure if this is the best solutions.Frequently someone/bot/crawler &nbsp;is trying to hit to make the CPU run very high like a DDOS kind of attack.Any pointer is appreciated.RegardsJanu

keesvandenbos · Answer

Hi Juna,You could use this irule:
when HTTP_REQUEST {
 if {!([string tolower [HTTP::query]] contains "utm" || [string tolower [HTTP::query]] contains "gclid")} {
  HTTP::respond 302 Location "http://www.domain.org"
}

brandon_ · Answer

Hello&nbsp;sunny123!
KeesvandenBos&nbsp;has provided a viable iRule solution, for a specific attack but to continue answering the second part; yes! Advanced WAF has denial of service capabilities specifically to mitigate these types of attacks.
Here is a great video overview of how behavioral DoS can react to stress on your backend systems and mitigate aggressive requests.
https://www.youtube.com/watch?v=uLhJNoEMsqA
There's an entire implementations guide "Preventing DoS Attacks on Applications"

https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-asm-implementations/preventing-dos-attacks-on-applications.html
And well, because a lot of these types of requests are automated, F5's bot defense can help you identify and mitgate automated requests.
HTH
-Brandon

Forum Discussion

F5 LTM/ASM , I-rule to ignore query string to prevent DDOS attack.

Recent Discussions

CRYPTO SCAM RECOVERY SERVICE – A LEGIT COMPANY FOR HIRE- DIGITAL TECH GUARD RECOVERY

Bypass "Bad unescape" in Body POST (ASM, POST, JSON)

URL redirect

Bypass the character for Evasion technique Detected violation

URL redirection

Related Content

The HTTP/2 CONTINUATION frame attack

Guarding Large Language Models: Advanced Approaches to Preventing Model Theft

Operationlizing Online Fraud Detection, Prevention, and Response

ESRP Strategies: DNS Water Torture Attack

Prevent some SQL attacks