Trying to Block a http-uri with irule

Did you try using a policy ?

LTM policy should work for basic stuff like this.

Impressive! This code can't work and you say it's now working.

there are 2 issues in the code:

• string "/Mirada_Test-portal" can't match a string forced to lower case
• even if you remove the string tolower, the character * in the condition is not in the requested URI. it is not used as a wildcard.

try this:

when HTTP_REQUEST {
     if { [string tolower [HTTP::path]] equals "/mirada_test-portal-fw-war-11.6.3/private/poll2.ajax" } {
     drop
    }
}

Dear axteliano,

I'm very new in F5, but why don't you try to create a signature to block this?

Fo my example, I've created a rule to block /etc/passwd, ignore the fact that this already exists into ASM database signatures.

Sould be similar to:

1 - Security -> Options -> Application Security -> Attack Signatures -> Create...

Name:Attempt Password File

Systems: Unix/Linux

Attack Types: Information Leakage

Rule: uricontent:"/etc/passwd"; nocase; objonly;

Accurancy: Low

Risk: High

2 - To define block:

2.1 - Security -> Application Security -> Attack Signatures -> Find the name, "Attempt Password File"

2.2 - Select it and Change Properties Enable: Yes

Perform Staging: No

2.3 - Apply changes to Selected Attack Signatures

2.4 - Apply Policy

Best Regards

Barone