Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been getting a couple of strange GET requests on my dev server from unknown IPs. I don't know if this is some weird character encoding or something entirely else. The mysterious thing is, my server responds with the status 200, so the input matches something, but I don't know what.

The request is ":\xcc\x89\xa9L\xcf\xc3\xb6\xc1\x8f\xa9\xe7\xc0\xec\x16"

Ideas?

EDIT: Corrected the request, it wasn't a GET request, but still returns the root index page.

EDIT2: A new one just popped up:
xxx.xxx.xxx.xxx - - [20/Oct/2010:09:10:33 +0300] ";\x8e\xb0!\xa2\xa7\xe7\x11\xf1HX\xb6\x188|z\x9b\xac;z\x10\xafn\xd8*fD\x9d\xc1\x11I\x9a5\xe6\xcbu,\x8c\xd7\x84O[\xf7\xca\xe67\xe5\xba\x94\xdd.\xc0d\xd0} " 200 2085 "-" "-"
Nope, definitely not unicode anymore...

share|improve this question

5 Answers 5

up vote 2 down vote accepted

Maybe a WebDAV hack similar to:

http://www.sans.org/security-resources/malwarefaq/webdav-exploit.php

Trying to exploit a buffer overrun.

share|improve this answer
    
From what I understand, these require one to still use WebDAV commands, not just the bytecode (or whatever the correct term might be). These requests have no command part, just the weid, unicode-ish characters. But it could be some new kind of buffer overrun attack however. –  onik Oct 20 '10 at 6:26

It could just be someone attempting to exploit your system. What is your server's response to the request ?

share|improve this answer
    
The response code is 200, size 2085, how can I find out more? I Tried to replicate the request with nc but all I get is 400 Bad Request... –  onik Oct 19 '10 at 9:57
    
Nevermind, got it, it gives the root index page... –  onik Oct 19 '10 at 10:00

Do you use SSL?

Access log like a request trying to talk SSL on a non-SSL.

share|improve this answer
    
No, ssl is not in use on this server. –  onik Oct 19 '10 at 9:06

Except for the third token, it looks like unicode character codes.

share|improve this answer
    
That's what I thought too, but couldn't find any way to verify, especially since \xa9L seems a bit odd... –  onik Oct 19 '10 at 10:13
    
I agree on the \xa9L. You can translate the other characters on this site: unicodelookup.com/#0xcc/1 –  Benoit Oct 19 '10 at 10:23

This certainly does not look like a valid HTTP request (could be an attempted attack.)

FWIW, my server (Apache 2.2.14) responds with "501 Method Not Implemented", which is its standard response to any request it does not recognize.

Is your server configured to rewrite anything it does not like to "/index.html" or some such?

share|improve this answer
    
No, no general rewrites are used, and certainly not to the root index. All rewrites are specific to their directories and applications. –  onik Oct 19 '10 at 10:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.