IIS.net

Adding ASP.NET Tracing to IIS 7.0 Failed Request Tracing

CarlosAg Blog — Fri, 04 Jul 2008 15:00:00 GMT

IIS 7.0 Failed Request Tracing (for historical reasons internally we refer to it as FREB, since it used to be called Failed Request Event Buffering, and there are no "good-sounding-decent" acronyms for the new name) is probably the best diagnosing tool that IIS has ever had (that doesn't require Debugging skills), in a simplistic way it exposes all the interesting events that happen during the request processing in a way that allows you to really understand what went wrong with any request. To learn...(read more)

Mapping a different file extension for ASPX Pages in IIS 7.0

CarlosAg Blog — Fri, 04 Jul 2008 14:00:00 GMT

Today I read a question in one of the IIS.NET forums - although I'm not sure if this is what they really wanted to know - I figured it might be useful to understand how to do this anyway. Several times users does not like exposing their ASP.NET pages using the default .aspx file extension (sometimes because of legacy reasons, where they try to minimize the risk of generating broken links when moving from a different technology, to preserve the validity of previous search-engines-indexes and sometimes...(read more)

Application Request Routing CTP1 has been released.

wonyoo — Fri, 04 Jul 2008 02:59:00 GMT

Application Request Routing (ARR) was just released yesterday (July 2, 08) and I wanted to highlight some of the core scenarios that the CTP1 release enables. (You can get more information on ARR and helpful walkthroughs here.)

3 tier deployment architecture: As the name indicates, there are 3 tiers: a web tier, an application tier, and a data tier. In this scenario, the web tier, where ARR is installed, would serve both a proxy based load balancer and a content server that serves static contents. The web tier inspects the incoming requests, and based on the routing rules, it can either decide to serve the contents from itself, or to route them to the application tier servers, which would serve the dynamic contents based on the business logic. This deployment architecture helps to scale the application tier by reducing the amount of traffic that are routed to the application tier servers. The goal would be to maximize and better utilize the server resources in the application tier. In addition, you can now scale the web tier and the application tier independently. You can learn more about how you can configure ARR in this scenario at this walkthrough.
Software load balance: This is a sub-scenario of the first scenario above. Instead of splitting the requests based on HTTP header or server variable, it forwards all requests to the content servers. In this scenario, ARR is being used as a reverse proxy based load balancer. You can learn more about how to use ARR in this scenario at this walkthrough.
Shared hosting using "host name affinity": This is a feature that is specifically designed for shared hosters. The overview of this scenario is well documented in this article. This is an exciting feature that simplifies how the shared hosters provide their services and also enables a straightforward scalability and availability story. You can learn more about how to use ARR in this scenario at this walkthrough.

Downloads:

Support:

The support is provided via ARR form which can be found at http://forums.iis.net/1154.aspx.

CTP2 of IIS7 PowerShell Provider Released!

thomad — Thu, 03 Jul 2008 17:06:00 GMT

Tech Preview 2 of the IIS7 PowerShell Provider is now available for download.

What’s new in Tech Preview 2?

IIS7 Powershell provider now supports SSL (installing and acquiring a certificate, creating an ssl site binding)
Tech Preview 2 ships with 40 new cmdlets. All of these cmdlets are for day-to-day IIS tasks like creating web-sites, web-applications, enabled request tracing, adding a handler or a module. The complete list is at http://learn.iis.net/page.aspx/492/using-the-task-based-cmdlets

IIS7 PowerShell Provider features:

Create Web-Sites, Web Applications, Virtual Directories and Application Pools
Change Simple Configuration Properties on Web-Sites, Application Pools, Web Applications and Virtual Directories
Add and Change Complex Configuration Settings
Query Run-time Data (Web-Site State, Application Pool State, Currently Executing Requests)
Execute Advanced Configuration Tasks, Scripting, Integration with other PowerShell Snap-Ins and features
Search and Discover Configuration Settings

DOWNLOAD:
Tech Preview 2 of the IIS 7.0 PowerShell Provider can be found here:

FORUMS:
Go to our PowerShell forum if you need support or if you are looking for 'Tips and Tricks'
http://forums.iis.net/1151.aspx

WALKTHROUGHS
The walkthroughs are here: http://learn.iis.net/page.aspx/447/managing-iis-with-the-iis-70-powershell-provider/

Visual Studio 2008 Web Server Here shell extension

ASP.NET Debugging : IIS — Thu, 03 Jul 2008 10:00:00 GMT

This has to be one of the coolest shell extensions that I have seen yet. It is right up there with the Command Prompt Here one. This adds a addition to the right-click menu for a folder for “ASP.NET Web Server Here”. All the information, including Read More......(read more)

Application Request Routing (ARR) CTP1 and PowerShell Provider CTP2 modules are released.

wonyoo — Wed, 02 Jul 2008 22:06:00 GMT

Today, we are excited to announce two module releases for IIS7:

Application Request Routing (ARR) CTP1
PowerShell Provider CTP2

Application Request Routing: Microsoft Application Request Routing for IIS7 is a proxy based routing module that forwards HTTP requests to content servers based on HTTP headers and server variables, and load balance algorithms.

For more information:

Walkthroughs and overview: http://learn.iis.net/page.aspx/489/using-the-application-request-routing-module/
Downloads:

Forum: http://forums.iis.net/1154.aspx

PowerShell:

For more information:

Walkthroughs and overview: http://learn.iis.net/page.aspx/447/managing-iis-with-the-iis-70-powershell-provider/
Downloads:

Blog: http://blogs.iis.net/thomad
Forum: http://forums.iis.net/1151.aspx

DiscountASP.net releases new IIS 7.0 Manager modules

CarlosAg Blog — Wed, 02 Jul 2008 16:00:00 GMT

DiscountASP.net who has been a very close partner of the IIS Team leading several offerings of our platform - including IIS Manager Remote Delegated Access to the Web Site and many other cool tools - has just built and released yet another cool module that extends the IIS Manager capabilities by having a GAC Viewer for their customers. The GAC Viewer is still in Beta but I think it showcases some of the cool stuff that IIS 7.0 platform brings to the table providing extensibility from end-to-end,...(read more)

SOS: Always use the correct debugger

ASP.NET Debugging : IIS — Wed, 02 Jul 2008 10:00:00 GMT

I cannot stress this enough. It is very important that you use the same architecture for the debugger as the process that you are trying to troubleshoot. Wrong version when capturing a dump If you use a 64-bit debugger to capture a dump of a32-bit Read More......(read more)

Life after FPSE (Part 4)

Robert McMurray's Blog [MSFT] — Tue, 01 Jul 2008 02:14:00 GMT

In continuation from my previous blog posts on on the subject of migrating from FPSE to WebDAV, today's blog post will address a combination of issues that I've run into and some implementation ideas. Listing content in virtual directories One different that I ran into rather quickly after I migrated a couple of web sites from FPSE to WebDAV was that suddenly my virtual directories were visible in my web authoring tool, which is Microsoft Expression Web. By default, virtual directories didn't show...(read more)

Using the new rules configuration in UrlScan v3.0 Beta (Part 2)

naziml — Mon, 30 Jun 2008 20:41:46 GMT

Dissecting the SQL injection sample in the walkthrough

I will spend some time dissecting the SQL injection rule posted in the walkthrough for UrlScan. Before I do so, I want to re-iterate the fact that SQL injection is a web application issue, and hence the right place to fix it is in the web application. Sometimes when you are the victim of a SQL storm, it is less than ideal to go figure out all the places your web application might be susceptible. That's where UrlScan comes in and offers a stop gap solution till you can fix the apps, without taking any downtime hit on your site. The one issue here is that of false positives ... and these are hard to predict because different web applications have different requirements and semantics. Nonetheless, UrlScan can offer substantial protection in the face of a SQL Storm at the cost of a some false positives that will cause valid requests to be rejected.

[SQL Injection]
AppliesTo=.asp,.aspx
DenyDataSection=SQL Injection Strings
ScanUrl=0
ScanAllRaw=0
ScanQueryString=1
ScanHeaders=

[SQL Injection Strings]
--
%3b ; a semicolon
/*
@ ; also catches @@
char ; also catches nchar and varchar
alter
begin
cast
create
cursor
declare
delete
drop
end
exec ; also catches execute
fetch
insert
kill
open
select
sys ; also catches sysobjects and syscolumns
table
update

So this is the first bit. Notice that the only thing we are scanning here is the query string, not the URL or any headers. This will give us a little more leeway with our strings list. But even so, there are a lot of chances for false positives. For example if were to have "podcast" in my query string, I would trip the filter because of "cast". So the best thing to do is copy this over and do quick testing to make sure your apps still work. The other thing to do is keep an eye on the log files to see what it is catching.

The obvious gap in the rule above is the fact that the only thing I am checking is the query string. What about the rest of the request? The parts of interest for SQL injection really depend on your web application ... but there are definitely some headers that seem important, like the Cookie header (popular candidate for script injection as well).

[SQL Injection Headers]
AppliesTo=.asp,.aspx
DenyDataSection=SQL Injection Headers Strings
ScanUrl=0
ScanAllRaw=0
ScanQueryString=0
ScanHeaders=Cookie:

[SQL Injection Headers Strings]
--
@ ; also catches @@
alter
cast
convert
create
declare
delete
drop
exec ; also catches execute
fetch
insert
kill
select

For folks who have been following this, you will notice that an older version was looking at ScanAllRaw. Even with a trimmed down list, there were a lot of things breaking. Like /* with the Accept-Encoding header and 'cast' in User-Agent strings that had things like 'broadcast'. So I followed my own advice and reduced the scope a little more.

Another part of the request that folks missed was the request entity, but the explanation for that deviated from this topic sufficiently to warrant its own blog here.

UrlScan v3.0 filtering based on Request Entity

naziml — Mon, 30 Jun 2008 20:21:35 GMT

While some folks are rejoicing, others are noticing the lack of scanning for the request entity. Why would we do that? The easy answer is that this is just not possible with an ISAPI filter. In IIS 5 and earlier, there is no API that would allow us to filter request entity, so request entity will never happen there. In IIS 6, the APIs exist to do this via * script maps, but the performance would be pretty bad. Also, there is no mechanism to treat the request as a stream, so there would be potential memory utilization problems. So we left it at that and said "can't do it, sorry".

But then you ask, "what about the request filtering module in IIS7"? Theoretically the IIS7 module APIs certainly let you analyze the request entity, so it is certainly possible. One of our current tasks is to bring the request filtering module up to par (feature-wise) with UrlScan v3.0 and then we can consider answering this complex problem. Yes, don't let this fool you ... analyzing request entity is a complex problem that has consequences for both performance and security. There is a multitude of things you need to account for here: compression/encryption, custom serialization, signature split between multiple POSTs, memory pressure due to entity buffering for POST data, etc. By no means are we claiming that this is an impossible task ... just that the cost to benefit ratio for this is low at this point. But we will try to look into this, time permitting.

Please feel free to send your thoughts/comments ... happy filtering !!

SOS: Upcoming release has a few new commands – HeapStat

ASP.NET Debugging : IIS — Mon, 30 Jun 2008 10:00:00 GMT

There are a lot of times where all you want to see are the sizes of the various heaps and generations. For the heaps, you can use !eeheap -gc to see the sizes, but the output can be a little difficult to read as it prints out so much other stuff Read More......(read more)

SQL Injection rule explaination how URLScan 3.0 scans requests

Steve Schofield Weblog : IIS — Fri, 27 Jun 2008 14:52:00 GMT

One of the things I was curious what URLScan actually scanned and how. What is just servervariables or what?! I asked Wade H from the IIS Team for further explaination. It is good to be aware when you are implementing URLScan 3.0 and sql injection rules Read More......(read more)

SOS: Upcoming release has a few new commands – DumpXmlDocument

ASP.NET Debugging : IIS — Fri, 27 Jun 2008 10:00:00 GMT

If you have done much debugging with XML data, you know how difficult it can be to look at a System.Xml.XmlDocument. They don’t just show up in the debugger as XML. This is where this command comes into play. It will take a XmlDocument Read More......(read more)

Web Based Link Checker

tomkmvp — Thu, 26 Jun 2008 17:15:00 GMT

I had a client the other day ask me if there was an easy way for him to check a page he had that had a list of over one hundred web sites. Obviously it's very tedious to have to go and click each link one by one, so I offered to try and come up with some code that can do it for him. While I know it's fairly trivial to write a Windows app that would do this, I wanted to make it web-based so it was easy to distribute and re-use within our organization.

Well, as it turns out, there's no "quick and easy" way to parse HTML with server-side ASP.NET code! In a Windows app it's easy to use a Webbrowser control and get an HTMLDocument object, but there's no server-side equivalent. After much searching I ran across something called the HTMLAgilityPack which made it super easy to get a list of A elements in a web page and parse out the text and href information.

Here's some simple code if you want to try something like this yourself ...

linkChecker.aspx

<form id="form1" runat="server">
<div>
URL to check: <asp:TextBox ID="TextBoxURL" runat="server" Width="550px" /> <asp:Button ID="ButtonGo" runat="server" Text="Go" />
</div>
<div>
<asp:literal ID="LinkTable" runat="server" />
</div>
</form>

linkChecker.aspx.vb

Imports SystemImports System.IO
Imports System.Net
Imports System.Text
Imports System.Runtime.InteropServices
Imports HtmlAgilityPack
 
Partial Class linkCheckerInherits System.Web.UI.Page
 
Protected Sub ButtonGo_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles ButtonGo.ClickDim hw As HtmlWeb = New HtmlWeb
Dim request As WebRequest = WebRequest.Create(TextBoxURL.Text) 'use this line if you need to authenticate
request.Credentials = New NetworkCredential("username", "password", "domain")Dim response As HttpWebResponse = CType(request.GetResponse(), HttpWebResponse)
Dim doc As HtmlDocument = New HtmlDocumentdoc.Load(response.GetResponseStream())
'select all the Anchor elementsDim hrefs As HtmlNodeCollection = doc.DocumentNode.SelectNodes("//a[@href]")Dim links As String = "<table style='width:100%;font-family:verdana;font-size:10pt;'>" & vbCrLf
For Each href As HtmlNode In hrefsDim linkColor As String = "blue"
Dim uri As String = href.Attributes("href").ValueIf InStr(uri, "http", CompareMethod.Text) > 0 Then
links += "<tr><td>"
Try
Dim testReq As WebRequest = WebRequest.Create(uri)Dim myProxy As New WebProxy()
myProxy.Address = New Uri(http://proxy.mydomain.com:8000)
'if you go through a proxy for external site but exclude for internals site, put your domain hereIf (InStr(uri, "mydomain.com/", CompareMethod.Text) > 0) Then
testReq.Proxy = Nothing
Else
testReq.Proxy = myProxyEnd If
Dim testRes As HttpWebResponse = CType(testReq.GetResponse(), HttpWebResponse)links += testRes.StatusDescriptionCatch ex As Exceptionlinks += "<span style='color:red;'>Err</span>"
linkColor = "red"
End Try
links += "</td><td>" & href.InnerHtml & "<br><a style='color:" & linkColor & ";' href='" & uri & "'>" & uri & "</a></td></tr>" & vbCrLfEnd If
Next
links += "</table>" & vbCrLfLinkTable.Text = linksEnd SubEnd Class