The discussion is specific to IIS 7 and later versions. Let's start with version IIS 7.0. It has a built-in feature that is able to filter HTTP requests. If a request is found to have contents which are unacceptable to process the request, then it will block such request there, before proceeding to process a request by a web application. This feature is useful as a mitigation technique, for such SQL Injection vulnerabilities.

Prerequisite
At first, verify the IIS version that you are using currently. If you are using earlier than IIS 7.0, then update with the latest version before applying the following configuration.

Configuring the Request Filter
To create a global filtering rule for SQL Injection, we should follow the below steps:

Step 1
Open the run window by pressing keyboard key Windows key + R and copy and paste the following code
%systemroot%\system32\inetsrv\config\applicationhost.config
 
It will open the applicationhost.config file.

Step 2
In the applicationhost.config file, identify <requestFiltering> section. Under this section, configure for the reserve keywords or reserved special characters, like DELETE, CREATE, UPDATE, INSERT, --,',/* etc. in <denyStrings> section.
Configure the file extensions for which IIS server needs to be validated. The sample code is shown below:

Step 3

Now, to save the file, go to the File menu and choose Save option.

How  does the above configuration behave in the IIS server?

With the above configuration settings, first of all, IIS will look at each incoming request for pages with .html, .aspx, or .asp extensions, to search for specific strings in the request's Query String. If the IIS server finds the specified strings, then IIS will block the request and return a 404: Not Found page to the client.
 
If you want to add a new file extension or change the existing file extensions in applicationhost.config file, you can add/remove the required file extensions in file Extension tags which lies in the <appliesTo> section. Whatever strings you are placing in the <denyStrings> section, the IIS looks for those strings. If it finds those, then it will block the request and return 404 error page to the client. You can add a new string, remove the existing string,  or change the existing string, in the <denyStrings> section.

In fact, in IIS server, you may have hosted many web applications which are running in parallel.
 
Let's say, for one of the web applications, you don't want to deny any string for the incoming request. How will you handle such  a scenario?
 
It is very simple. Create a rule in your application's config file, for which, you want to allow all such strings. If you create a rule in the application's config file, it will override the applicationhost.config file's rule. For instance, if you want to allow the string "end" for only a few applications,  and for the rest of the applications, you want to deny such a string, then follow the below steps:

Step 1: Remove the <add string="end" /> entry from applicationhost.config file.

Step 2: Add the below code into the application's config file where you want to restrict the string "end":

Make a note --  the name for the filteringRule tag must and should be unique and it should not conflict with a name which is in the applicationhost.config file or/and the same name with any other web.config files in the path. And, it is also possible to limit the scope of filtering rules using location tags.

Procedure to check logs for SQL Injection attempts

You can check the SQL injection attempt logs in IIS W3SVC logs section. filteringRule rejects such SQL injection attempts and responds with a 404 status and with a substatus 19. You have to check these logs periodically to make sure that your rule is blocking such SQL Injections for the legitimate requests.

After the configuration changes made in the applicationhost file, if you give the followingURL request in your browser, the following output will show:

http://localhost/OWASP.UI/UnvalidatedRedirectsForwards/ValidatedRedirectsForwards.aspx?returnUrl=http://www.flipkart.com/--

Output

HostForLIFE.eu IIS 10 Hosting
HostForLIFE.eu is European Windows Hosting Provider which focuses on Windows Platform only. We deliver on-demand hosting solutions including Shared hosting, Reseller Hosting, Cloud Hosting, Dedicated Servers, and IT as a Service for companies of all sizes.

European leading web hosting provider, HostForLIFE.eu announces the launch of Visual Studio 2017 Hosting

HostForLIFE.eu was established to cater to an underserved market in the hosting industry; web hosting for customers who want excellent service. HostForLIFE.eu - a cheap, constant uptime, excellent customer service, quality, and also reliable hosting provider in advanced Windows and ASP.NET technology. HostForLIFE.eu proudly announces the availability of the Visual Studio 2017 hosting in their entire servers environment.

The smallest install is just a few hundred megabytes, yet still contains basic code editing support for more than twenty languages along with source code control. Most users will want to install more, and so customer can add one or more 'workloads' that represent common frameworks, languages and platforms - covering everything from .NET desktop development to data science with R, Python and F#.

System administrators can now create an offline layout of Visual Studio that contains all of the content needed to install the product without requiring Internet access. To do so, run the bootstrapper executable associated with the product customer want to make available offline using the --layout [path] switch (e.g. vs_enterprise.exe --layout c:\mylayout). This will download the packages required to install offline. Optionally, customer can specify a locale code for the product languages customer want included (e.g. --lang en-us). If not specified, support for all localized languages will be downloaded.

HostForLIFE.eu hosts its servers in top class data centers that is located in Amsterdam (NL), London (UK), Paris (FR), Frankfurt(DE) and Seattle (US) to guarantee 99.9% network uptime. All data center feature redundancies in network connectivity, power, HVAC, security, and fire suppression. All hosting plans from HostForLIFE.eu include 24×7 support and 30 days money back guarantee. The customers can start hosting their Visual Studio 2017 site on their environment from as just low €3.00/month only.

HostForLIFE.eu is a popular online ASP.NET based hosting service provider catering to those people who face such issues. The company has managed to build a strong client base in a very short period of time. It is known for offering ultra-fast, fully-managed and secured services in the competitive market.

HostForLIFE.eu offers the latest European Visual Studio 2017 hosting installation to all their new and existing customers. The customers can simply deploy their Visual Studio 2017 website via their world-class Control Panel or conventional FTP tool. HostForLIFE.eu is happy to be offering the most up to date Microsoft services and always had a great appreciation for the products that Microsoft offers.

Further information and the full range of features Visual Studio 2017 Hosting can be viewed here http://hostforlife.eu/European-Visual-Studio-2017-Hosting

In this tutorial, I will tell you about Manage IIS with Appcmd. What is Appcmd? The appcmd.exe is a single command, used to manage IIS 7 and above. It is used to manage the Server without using a graphical administration tool. The appcmd is located in C:\Windows\System32\inetsrv (%systemroot%\system32\inetsrv\) directory. By default, it will not add into environment variable. 

Key Features 

• Creating and configuring the sites.
• To list the running worker process.
• Backup and restoring the site configuration.
• Retrieve the information about the Application pools.

Object Types

• List
• Add
• Delete
• Set
• Hide

Syntax

appcmd <objecttypes> <parameters>   

set path=%path%;%systemroot%\system32\inetsrv; //used to set the environment variable   

To list all the sites, use the command, given below:

appcmd list sites     

To get the details of a specific site binding and status (stopped/start), use the command, given below:

appcmd list site "Default web site"  

To list all the sites, which had been stopped, use the command, given below:

appcmd list sites /state:Stopped   

To add a new site, use the command, given below:

appcmd add site /name:"added using appcmd" /bindings:"http/*:81:localhost" /physicalPath:"D:\test"

To add an https binding to the site, use the command, given below:

appcmd set site /site.name:"added using appcmd" /+bindings.[protocol='https',bindingInformation='127.0.0.1:444:localhost']  

To list all the applications, use the command, given below:

Appcmd list app  

To change an application pool, use the command, given below:

appcmd set app "added using appcmd/app1" /applicationPool:appcmdpool  

To view the application pool details including the username and password of the app account, use the command, given below:

appcmd list apppool "MyAppPool" /text:*  

Backup

appcmd add backup   

appcmd add backup "locahostbkup"  

appcmd list backup   

appcmd delete backup "backup name"  

Restore

appcmd restore backup "locahostbkup "  

appcmd restored configuration from backup "locahostbkup"  

To view the list of the worker process, which will help us to attach the debugger in Visual Studio, use the command, given below:

appcmd list wps  

To view the list of the physical path, use the command, given below:

appcmd list vdirs /text:physicalPath   

To start and stop the sites, use the command, given below:

appcmd start site "Default web site"  

appcmd stop site "Default web site"

HostForLIFE.eu IIS 7.5 Hosting
HostForLIFE.eu is European Windows Hosting Provider which focuses on Windows Platform only. We deliver on-demand hosting solutions including Shared hosting, Reseller Hosting, Cloud Hosting, Dedicated Servers, and IT as a Service for companies of all sizes. We have customers from around the globe, spread across every continent. We serve the hosting needs of the business and professional, government and nonprofit, entertainment and personal use market segments.

HostForLIFE.eu was established to cater to an underserved market in the hosting industry; web hosting for customers who want excellent service. HostForLIFE.eu - a cheap, constant uptime, excellent customer service, quality, and also reliable hosting provider in advanced Windows and ASP.NET technology. HostForLIFE.eu proudly announces the availability of the ASP.NET Core 1.0 RC2 hosting in their entire servers environment.

In this article, let me show you how to setting up IIS on your Windows 10 OS. I am using Windows 10 Enterprise edition.

First, open the browser and just type the url http://localhost/ shown on the below picture:

When you pressing Enter, it will throw page not found error.
Now I am going to search for IIS manager. Not found!
Then, open Control Panel -> Click Programs.
Under Programs and Features, click Turn Windows features on or off.

The popup will appear as you can see on the following picture:

Just check the Internet Information Services and its related features.
Under Internet Information Services check the following folders:

• FTP Server
• Web Management Tools
• World wide web services
• Application development features
• Common HTTP Feature
• Health and Diagnostics
• Perfomance Feature
• Security

Then click OK to complete the installation of new features.
Click Restart now to apply changes to complete the IIS feature installation.

After restart, you will see the IIS webserver option on the All Programs menu. Now, open the browser then write on address bar http://localhost.

Internet Information Services (IIS) successfully configured!

HostForLIFE.eu IIS 8.0 Hosting
HostForLIFE.eu is European Windows Hosting Provider which focuses on Windows Platform only. We deliver on-demand hosting solutions including Shared hosting, Reseller Hosting, Cloud Hosting, Dedicated Servers, and IT as a Service for companies of all sizes. We have customers from around the globe, spread across every continent. We serve the hosting needs of the business and professional, government and nonprofit, entertainment and personal use market segments.

IIS usually works well in Windows. but sometimes, we have a tendency to customize it to serve a required setting for a specific web project. If we install Xampp in Windows, default Xampp configuration forces IIS to decline its normal beaver or any custom configuration could be the cause.

So let’s see however we are able to reset IIS to its default settings. i'm working with Windows 8 and IIS 8.

Reset IIS

Go to 'Control Panel\Programs’.
Click 'Turn Windows feature on or off'.

Now, uncheck these two check boxes.
Click OK
And then, reboot/restart machine.

Again Go to 'Control Panel\Programs'.
Click 'Turn Windows feature on or off'.
Check these two check boxes.
Click ok.
Reboot/Restart machine.

Go to 'C:\Windows\System32\Drivers\etc'.
Open the 'hosts' file with Notepad.

Remove the Custom IP configurations, if any.
Save the edited hosts file ‘Ctrl+s’.

If Windows doesn’t let you save the 'hosts' file, copy the hosts file to another location.
Do edit and save.

Replace the 'hosts' file at 'C:\Windows\System32\Drivers\etc' with your edited 'hosts' file and we are ready to go.
"turn windows features on" An error has occurred. Not all of the features were successful.

HostForLIFE.eu IIS 8.0 Hosting
HostForLIFE.eu is European Windows Hosting Provider which focuses on Windows Platform only. We deliver on-demand hosting solutions including Shared hosting, Reseller Hosting, Cloud Hosting, Dedicated Servers, and IT as a Service for companies of all sizes. We have customers from around the globe, spread across every continent. We serve the hosting needs of the business and professional, government and nonprofit, entertainment and personal use market segments.

European Windows and ASP.NET Spotlight Hosting Partner in Europe, HostForLIFE.eu, has announced the availability of new hosting plans that are optimized for the latest update of the Drupal 7.37 hosting technology.

HostForLIFE.eu hosts its servers in top class data centers that is located in Amsterdam (NL), London (UK), Paris (FR), Frankfurt(DE) and Seattle (US) to guarantee 99.9% network uptime. All data center feature redundancies in network connectivity, power, HVAC, security, and fire suppression. All hosting plans from HostForLIFE.eu include 24×7 support and 30 days money back guarantee. The customers can start hosting our Drupal site on our environment from as just low €3.00/month only.

Drupal is an open source content management platform powering millions of websites and applications. Thousands of add-on modules and designs let you build any site you can imagine. Drupal 7.37 Includes bug fixes and small API/feature improvements only (no major new functionality); major, non-backwards-compatible new features are only being added to the forthcoming Drupal 8.0 release. If you are looking for the right Windows ASP.NET Hosting provider that support Drupal 7.37, we are the right choice for you.

The 7.37 update also includes fixed a regression in Drupal 7.36 which caused certain kinds of content types to become disabled if we were defined by a no-longer-enabled module, removed a confusing description regarding automatic time zone detection from the user account form (minor UI and data structure change), allowed custom HTML tags with a dash in the name to pass through filter_xss() when specified in the list of allowed tags, allowed hook_field_schema() implementations to specify indexes for fields based on a fixed-length column prefix (rather than the entire column), as was already allowed in hook_schema() implementations, fixed PDO exceptions on PostgreSQL when accessing invalid entity URLs, added a sites/all/libraries folder to the codebase, with instructions for using it and added a description to the "Administer text formats and filters" permission on the Permissions page (string change).

HostForLIFE have hosted large numbers of websites and blogs until now. Our clients come from diverse backgrounds from all sectors of the economy. HostForLIFE.eu clients are specialized in providing supports for Drupal for many years. We are glad to provide support for European Drupal 7.37 hosting users with advices and troubleshooting for our client website when necessary.

HostForLIFE.eu is a popular online Windows based hosting service provider catering to those people who face such issues. The company has managed to build a strong client base in a very short period of time. It is known for offering ultra-fast, fully-managed and secured services in the competitive market. Our powerful servers are especially optimized and ensure Drupal 7.37 performance. We have best data centers on three continent, unique account isolation for security, and 24/7 proactive uptime monitoring.

For more information about this new product, please visit http://hostforlife.eu/European-Drupal-737-Hosting

About HostForLIFE.eu
HostForLIFE.eu is an European Windows Hosting Provider which focuses on the Windows Platform only. HostForLIFE.eu deliver on-demand hosting solutions including Shared hosting, Reseller Hosting, Cloud Hosting, Dedicated Servers, and IT as a Service for companies of all sizes.

HostForLIFE.eu is awarded Top No#1 SPOTLIGHT Recommended Hosting Partner by Microsoft (see http://www.asp.net/hosting/hostingprovider/details/953). Our service is ranked the highest top #1 spot in several European countries, such as: Germany, Italy, Netherlands, France, Belgium, United Kingdom, Sweden, Finland, Switzerland and other European countries. Besides this award, we have also won several awards from reputable organizations in the hosting industry and the detail can be found on our official website.

In this article you'll find out how to assemble a Firewall to support a FTP website in IIS. Through this text we are going to assemble the Firewall so the FTP Server may be enabled to receive a Passive knowledge association type the Firewall.

First of all open your administrative Tools from the start Menu.

Now your Administrator Tools are going to be opened, among these tools you'll find an option named "IIS Manager", double click on this feature to open it.

On the left hand side you'll see that a pane is provided named "Connection pane", during this connection pane your server name are going to be provided. And now click on this Server Name to open it.

Now within the FTP features view an option will be accessible named "FTP Firewall Support", double-click on this feature to open it.

Now the Firewall Support Page is going to be opened, here you'll see that 2 Text Boxes are provided, one for the port and another for the IP Address.

Now offer the range of Ports for the data Channel Port range, however keep in mind that you just cannot offer the range between 0 and 1024 since these ports are reserved ports.

After providing the Port range and IP Address, click on the "Apply" button provided within the connection Pane.

IIS 8.0 with Free ASP.NET Hosting
Try our IIS 8.0 with Free ASP.NET Hosting today and your account will be setup soon! You can also take advantage of our Windows & ASP.NET Hosting support with Unlimited Domain, Unlimited Bandwidth, Unlimited Disk Space, etc.