what Microsoft application/tool could you use to mitigate this attack?

Question

If you were not using Apache as the reverse proxy, what Microsoft application/tool could you use to mitigate this attack?

Answer 1

You could use either Microsoft's Internet and Security Acceleration (ISA) server as a front-end proxy or implement URLScan on the target IIS server. The urlscan.ini file has the AllowDotInPath directive which will block directory traversal attempts.