0

I've been seeing a lot of these in my Apache 2 logs recently:

Invalid URI in request \xff\x97\x9f\xfe;J\xe8K$J\x1b\xef\xebr?6\xac\x1aG,\xc6\x81\x0eW{G\xf0\xdf\x82\x9a\xfb\xd0\t\v\xf1\xdf\xbc"\xec|\xd8A\x1a\x87\x98\xa2\xa0\x89\xf1\\\xa3\xce\xca\xbap\xce\xcd\xc8\xdd\x7f\xffJ
Invalid method in request \x89\x84<?q8mz\x8ek\xcb6\xf1\xb8\xd2\xf61G\x86\x9e0\xd2\x91\xdd]/f\xda\x06\xc6\xed\xd3\xdb0\xf5\xd2`\xee\\C\x03\x18\xcd\x8e0\xfdI
Invalid URI in request US\xaa\xb1\xc4\xf2,\xe6\xcaw\xf6tQ\x0cy\xc1\xb2\xaf\xf9\xa1f\xf3

I imagine these are hex encoded strings, but looking on the net I couldn't find much info about this kind of attack, also due to Google making it very hard (or should I say impossible) to exactly match strings like \x (and this is a real bug IMHO).

How should i interpret these hack attempts?

2 Answers 2

2

Someone is attempting to pass binary data to your server. Likely an overflow attempt.

1
  • should i be worried? :)
    – asymmetric
    Jan 20, 2011 at 21:14
0

Can you look at the requests that precede these from the same IP? This could be a broken HTTP client sending binary data with an incorrect/invalid content-length or encoding, and some of the latter parts of the upload are interpreted as a subsequent request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .