Sample UrlScan.ini File

Below is a sample UrlScan.ini file.

[Options]

UseAllowVerbs=1                ; If 1, use [AllowVerbs] section, else use the

                               ; [DenyVerbs] section.   The default is 1.

UseAllowExtensions=0           ; If 1, use [AllowExtensions] section, else

                               ; use the [DenyExtensions] section. The

                               ; default is 0.

NormalizeUrlBeforeScan=1       ; If 1, canonicalize URL before processing.

                               ; The default is 1. Note that setting this

                               ; to 0 will make checks based on extensions,

                               ; and the URL unreliable and is therefore not

                               ; recommend other than for testing.

VerifyNormalization=1          ; If 1, canonicalize URL twice and reject

                               ; request if a change occurs. The default

                               ; is 1.

AllowHighBitCharacters=0       ; If 1, allow high bit (ie. UTF8 or MBCS)

                               ; characters in URL. The default is 0.

AllowDotInPath=0               ; If 1, allow dots that are not file

                               ; extensions. The default is 0. Note that

                               ; setting this property to 1 will make checks

                               ; based on extensions unreliable and is

                               ; therefore not recommended other than for

                               ; testing.

RemoveServerHeader=1           ; If 1, remove the 'Server' header from

                               ; response. The default is 0.

EnableLogging=1                ; If 1, log UrlScan activity. The

                               ; default is 1. Changes to this property

                               ; will not take effect until UrlScan is

                               ; restarted.

PerProcessLogging=0            ; This property is deprecated for UrlScan

                               ; 3.0 and later. UrlScan 3.0 and later can

                               ; safely log output from multiple processes

                               ; to the same log file. Changes to this

                               ; property will not take effect until

                               ; UrlScan is restarted.

AllowLateScanning=0            ; If 1, then UrlScan will load as a low

                               ; priority filter. The default is 0. Note

                               ; that this setting should only be used in

                               ; the case where there another installed

                               ; filter is modifying the URL and you wish

                               ; to have UrlScan apply its rules to the

                               ; rewritten URL. Changes to this property

                               ; will not take effect until UrlScan is

                               ; restarted.

PerDayLogging=1                ; If 1, UrlScan will produce a new log each

                               ; day with activity in the form

                               ; 'UrlScan.010101.log'. If 0, UrlScan will

                               ; log activity to urlscan.log. The default

                               ; is 1. Changes to this setting will not

                               ; take effect until UrlScan is restarted.

UseFastPathReject=0            ; If 1, then UrlScan will not use the

                               ; RejectResponseUrl. On IIS versions less

                               ; than 6.0, this will also prevent IIS

                               ; from writing rejected requests to the

                               ; W3SVC log. UrlScan will log rejected

                               ; requests regardless of this setting. The

                               ; default is 0.

LogLongUrls=0                  ; This property is deprecated for UrlScan 3.0

                               ; and later. UrlScan 3.0 and later will

                               ; always include the complete URL in its log

                               ; file.

UnescapeQueryString=1          ; If 1, UrlScan will perform two passes on

                               ; each query string scan, once with the raw

                               ; query string and once after unescaping it.

                               ; If 0, UrlScan will only look at the raw

                               ; query string as sent by the client. The

                               ; default is 1. Note that if this property is

                               ; set to 0, then checks based on the query

                               ; string will be unreliable.

RejectResponseUrl=

LoggingDirectory=Logs

[AllowVerbs]

;

; The verbs (aka HTTP methods) listed here are those commonly

; processed by a typical IIS server.

;

; Note that these entries are effective if "UseAllowVerbs=1"

; is set in the [Options] section above.

;

GET

HEAD

POST

[DenyVerbs]

;

; The verbs (aka HTTP methods) listed here are used for publishing

; content to an IIS server via WebDAV.

;

; Note that these entries are effective if "UseAllowVerbs=0"

; is set in the [Options] section above.

;

PROPFIND

PROPPATCH

MKCOL

DELETE

PUT

COPY

MOVE

LOCK

UNLOCK

OPTIONS

SEARCH

[DenyHeaders]

;

; The following request headers alter processing of a

; request by causing the server to process the request

; as if it were intended to be a WebDAV request, instead

; of a request to retrieve a resource.

;

Translate:

If:

Lock-Token:

Transfer-Encoding:

[AllowExtensions]

;

; Extensions listed here are commonly used on a typical IIS server.

;

; Note that these entries are effective if "UseAllowExtensions=1"

; is set in the [Options] section above.

;

.htm

.html

.txt

.png

.png

.png

[DenyExtensions]

;

; Extensions listed here either run code directly on the server,

; are processed as scripts, or are static files that are

; generally not intended to be served out.

;

; Note that these entries are effective if "UseAllowExtensions=0"

; is set in the [Options] section above.

;

; Also note that ASP scripts are denied with the below

; settings. If you wish to enable ASP, remove the

; following extensions from this list:

;    .asp

;    .cer

;    .cdx

;    .asa

;

; Deny executables that could run on the server

.exe

.bat

.cmd

.com

; Deny infrequently used scripts

.htw     ; Maps to webhits.dll, part of Index Server

.ida     ; Maps to idq.dll, part of Index Server

.idq     ; Maps to idq.dll, part of Index Server

.htr     ; Maps to ism.dll, a legacy administrative tool

.idc     ; Maps to httpodbc.dll, a legacy database access tool

.shtm    ; Maps to ssinc.dll, for Server Side Includes

.shtml   ; Maps to ssinc.dll, for Server Side Includes

.stm     ; Maps to ssinc.dll, for Server Side Includes

.printer ; Maps to msw3prt.dll, for Internet Printing Services

; Deny various static files

.ini     ; Configuration files

.log     ; Log files

.pol     ; Policy files

.dat     ; Configuration files

.config  ; Configuration files

[DenyUrlSequences]

;

; If any character sequences listed here appear in the URL for

; any request, that request will be rejected.

;

..  ; Don't allow directory traversals

./  ; Don't allow trailing dot on a directory name

\   ; Don't allow backslashes in URL

:   ; Don't allow alternate stream access

%   ; Don't allow escaping after normalization

&   ; Don't allow multiple CGI processes to run on a single request