Request for providing help on setting up an iRule

Here is an example:

ltm data-group internal example_uri_1 {
     records {
         cs.exe { }
         llisapi.dll { }
             }
     type string
}

when HTTP_REQUEST {
         if { ([matchclass [string tolower [HTTP::uri]] contains example_uri_1]) and ([string tolower [HTTP::query]] contains "%3D%23") }{
                HTTP::respond 403 content "You don't have authorization to view this page. Access Denied" noserver Content-Type text/html Connection Close Cache-Control no-cache

            }
}

For the form post variable, I think you need to have APM. 

Hi abhinay , 
As mihaic figured out his iRule , it should meet your requirements. 
I want to add only this part to specify the ( Query string name and value ) in Requests 
you can add to mihaic iRule : 

[URI::query [HTTP::uri] "fInArgs"] equals "%3D%23"]

#add this part after and operator in iRule instead of ([string tolower[HTTP::query]...)
it is only to be more specified
 

I think NetOpsCommercial asks for this part , is not it. 

mihaic , Did you simulated this irule and get its results ? 

can you provide what HTTP payload looks like? 

As far as I understand you need to look for some variable and its value in the HTTP payload.

Mohamed_Ahmed_Kansoh  is right, we need to remove "string tolower" part.

I only tested that the syntax is ok. The functionality, no. Did not have time yet.

Here is the irule with the variable also:(not functional tested):

ltm data-group internal example_uri_1 {
     records {
         cs.exe { }
         llisapi.dll { }
            }
type string
}

when HTTP_REQUEST { 
       if { ([matchclass [string tolower [HTTP::uri]] contains example_uri_1]) and ( [HTTP::query] contains "%3D%23") }{
           HTTP::respond 403 content "You don't have authorization to view this page. Access Denied" noserver Content-Type text/html Connection Close Cache-Control no-cache

          } 
}


when HTTP_REQUEST_DATA {

    if { [HTTP::method] equals "POST" }{
# Extract the entire HTTP request body and escape it to become a HTTP::uri string (for easier parsings) 
         set http_request_body "?[HTTP::payload [HTTP::header value "Content-Length"]]"
# Try to parse type value from the HTTP request body.
      if { [URI::decode [URI::query $request_body fInArgs]] equals "%3D%23" } {
           log local0. "fInArgs : $fInArgs"
           HTTP::respond 403 content "You don't have authorization to view this page. Access Denied" noserver Content-Type text/html Connection Close Cache-Control no-cache 
} 
} 
}

Hello abhinay ,
I've recently implemented a similar check on one of my customers. Try the following:

when HTTP_REQUEST { 
 if { [HTTP::uri] contains "cs.exe" || [HTTP::uri] contains "llisapi.dll" }{ 

    if { [URI::decode [HTTP::query]] contains "flnArgs" }{ 
     set value [findstr [URI::decode [HTTP::query] "flnArgs" 7 &]
	 if { $value contains "#=" }{
	   log local0. "violation detected: flnArgs=$value"  
	   HTTP::respond 403 content "Forbidden" 
	   
	   
	 } else {
     # if URI does not contain parameter, I capture traffic (up to 1MB) and perform this check again on full payload

       if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{ 
         set content_length [HTTP::header "Content-Length"]
       } else { set content_length 1048576 }
       if { $content_length > 0} { HTTP::collect $content_length ; set checkpayload 1 }
	   
     }
  }
}
when HTTP_REQUEST_DATA {
  if { $checkpayload }{ 
    set cleanpl [URI::decode [HTTP::payload]]
    set value [findstr $cleanpl "flnArgs" 7 &]
	if { $value contains "#=" }{
	   log local0. "violation detected: flnArgs=$value" 
	   HTTP::respond 403 content "Forbidden" 
	}
  }	
}

Notice that I'm decoding URI so %3D%23 will be normalized to #= , this match is more effective IMO

from what you shared  the the key is "_fInArgs= " and the value is not what you asked for . it is not "%3D%23"

"key": "_fInArgs=",
							"value": "A<1,?,'_ApiName'='SessionFree','_ConnectionName'=#AAAA>",

 the format you shared seems to be a JSON 

try to put something from the value.

for it works this:

set token [lindex [ regexp -inline -- {"value": "(.+)"} [HTTP::payload] ] 1]
if { $token contains "SessionFree" } {
    log local0. "token: $token"
    HTTP::respond 403 content "You don't have authorization to view this page. Access Denied" noserver Content-Type text/html Connection Close Cache-Control no-cache 
} } 

 But the problem is that it checkes everything starting teh first "value" it finds till the end.

I could not yet do a search only for key "_fInArgs=" and match only something in its value.

As this is a json format, we need a way to parse json.

here is a better way.

set varB [findstr [HTTP::payload] "fInArgs=" 33 type]
if { $varB contains "SessionFree" } {
       HTTP::respond 403 content "You don't have authorization to view this page. Access Denied" noserver Content-Type text/html Connection Close Cache-Control no-cache 
} 

 I've managed to extract the value field.

This works for me.