Forum Discussion
F5Hopper_28651
Nimbostratus
NimbostratusRegex in iRule
Im making a rule to catch bad code being in HTTP POST.
for some reason we have some sites trying to do some sort of XSS attack, but posting URL strings in the POST and then they get a 500error. ...
Kevin_Stewart
Employee
EmployeeHere's a rough example:
when HTTP_REQUEST {
if { [HTTP::method] equals "POST" } {
log local0. "query = [URI::decode [HTTP::query]]"
if { [string match -nocase {*<[a-zA-Z!]*} [URI::decode [HTTP::query]]] } {
log local0. "Gotcha!"
reject
}
}
}
In the above example I'm URI decoding the HTTP query in POST requests, which will catch URI encoding of the < character.