For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Esteban_Araya_3's avatar
Esteban_Araya_3
Icon for Nimbostratus rankNimbostratus
Feb 08, 2019

Irule for DDOs Attacks!

Hello,   I´m working with a client that is getting DD0s attacks from random IPs. We have some limitations with the Hardware as we only have an ASA and the F5 but no additional security modules, an...
application delivery
BIG-IP
iRules
security
Dylan_375544's avatar
Dylan_375544
Icon for Cirrocumulus rankCirrocumulus
Feb 08, 2019

The one issue I see is that you have "UNION%20SELECT%20" as what you are searching for.

 

But you also have "stringtolower" which would change the URI to all lowercase, and therefore "UNION%20SELECT%20" would never actually show up since it is in CAPS.

 

Change that to "union%20select%20"

 

Hope that helps! If it does please up-vote and select this answer, it'd be greatly appreciated!

 

-Dylan

 

  • Dylan_375544's avatar
    Dylan_375544
    Icon for Cirrocumulus rankCirrocumulus
    Feb 08, 2019

    I got beat to the punch! :D

     

  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Feb 08, 2019

    Get out of here Dylan. This is my turf!

     

  • Dylan_375544's avatar
    Dylan_375544
    Icon for Cirrocumulus rankCirrocumulus
    Feb 08, 2019

    Your answer is more thorough. ;)

     

  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Feb 08, 2019

    You did a great job buddy.