iRule for blocking specific traffic for HTTP POST
Hi Everyone, I need some help in setting up an iRule for below requirement.
Need to get 403 Forbidden for below
(method = POST) AND (URI contains /cs OR llisapi.dll) AND (body contains func=qds.) AND (body contains _REQUEST=SYNDICATION_REQUEST)
Below is the Postman body that I am testing
"body": {
"mode": "formdata",
"formdata": [
{
"key": "func",
"value": "qds.ObjAction",
"type": "default"
},
{
"key": "_REQUEST",
"value": "SYNDICATION_REQUEST",
"type": "default"
},
{
"key": "qdsRequest",
"value": "A<1,?,'objAction'='create2','subtype'=145,'versionFile_filename'='C:\\windows\\win.ini','func'='',\n'ParentID'=2004,'objType'=145,'name'='qds-createpoc.\ntxt','comment'='created','mimeType'='text/html','textfield'='foobar','CTT_ID'='2004','multiC\nlass'=0,'InheritRequired'=0,'CREATE_Required'=1,'CREATE_Edited'=0,'CREATE_CacheID'=0,'CREATE_Ver\nNum'=1,'versionFile_filelength'='5'>",
"type": "default"
}
]
},
Thank you