Content rule to block XSS attack <script> tags in URL

This article outlines a solution for blocking XSS attack <script> tags in defined URLs and returning a 403 Forbidden error message.

Product: LoadMaster

Version: Any

Platform: Any

Application: Any

How to block XSS attack <script> tags in defined URLs on the LoadMaster using a single content rule?

Below is an example syntax for a content rule that blocks XSS attack <script> tags in defined URLs:

Rule Name:  block_XSS
Rule Type:   Content Matching
Match Type:   Regular Expression
Header Field:   <empty>
Match String:  /<script>/
Negation:   False
Ignore Case:   True
Include Host in URL:   False
Include Query in URL:   True
Fail On Match:   True

After creating the above content rule, it is then necessary to apply it under a Virtual Service or Sub Virtual Service (SubVS) as a HTTP Selection rule under Advanced Properties. 

Then under the same Advanced Properties, set the Not Available Redirection Handling to 403 Forbidden and set an error message.

Now test a URL that contains a script query to see if the content rule works as expected by returning the 403 error message. An example test URL could be as follows:

https://test.domain.com/testscript.php?value=x<script>alert("XSS Attack!")</script>

Content Rules Guide:

https://support.kemptechnologies.com/hc/en-us/articles/7170469507341-Content-Rules

Regex101:

https://regex101.com/