Someone trying to hack our server "/index.php?option=../../etc/passwd"

[icanhazburger]

Hi all, one of our clients has got a Joomla (yuck, not our choice) website hosted on our server.

It's a windows server and earlier today their site kept on becoming unavaliable. I checked task manager on the server and their app pool was taking 100% cpu! I downloaded and ran IISPeek and found the following 2 url requests were causing the problem, I then blocked the ip range these were coming from and normality was restored.



As its a Windows server the file they are trying to locate is obviously not going to exist. But it was causing the site to crash.

So my question is - Can I block those url requests or stop the server from trying to process them?

[.walls]

You can use URLScan to disable unsafe characters (such as the double period). It's part of the IIS lockdown tool.