Wade Hilmo
-
Dynamic IP Restriction Proxy Mode
-
Application Initialization Part 2
In my last post, I gave a bit of background on the Application Warm-Up module, now called Application Initialization. This week, I would like to go into more detail as to what the Application Initialization module does, and how you should think about using it.
-
(Re)introducing Application Initialization
“IIS is a demand-driven web server, i.e. IIS does things only when asked for…”
-
How IIS blocks characters in URLs
Recently, the question came up about why it is not possible for IIS to handle a URL that contains a ‘%’ character that is not part of an escape sequence. The resulting discussion produced some informative references to the relevant RFC documents and also included some anecdotes on URL canonicalization.
-
Understanding Versions of the IIS FTP Server
It’s been a busy few days on the IIS Security Team.
-
Running Perl on IIS 7
We've had a few people on our forums asking about running Perl on IIS 7. This led to some discussion on the team about getting it to work with FastCGI.
-
How IIS can help with SQL Injection
2008 has been a busy year for attackers exploiting SQL Injection vulnerabilities in web applications. Once again, I am finding questions about this subject in my inbox.
-
Filtering for SQL Injection on IIS 7 and later
This article is specific to IIS 7 and later. If you are using IIS 6.0 or earlier, please see this article.
-
Filtering for SQL Injection on IIS 6 and earlier
This article is specific to IIS 6 and earlier. If you are using IIS 7.0 or later, please see this article.
-
UrlScan 3.1
Earlier this year, it came to our attention that our customers were being subjected to a SQL Injection attack. In response to that, we updated the venerable UrlScan filter and released version 3.0 with new features that provide tools to provide some mitigation and allow users to address issues in their affected applications.