Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Well someone is requesting some URL's with really strange hex codes.

How can I find out what they are up to. The problem is I don't even know what code that is, it's not a hex code.

How can I find out what's going on here?

share|improve this question
    
I guess this could be some form of buffer overflow exploit - but not really sure what I can do about it –  mashup Jul 25 '11 at 15:19

2 Answers 2

up vote 1 down vote accepted

If it's definitely not something you'd expect for your application it is entirely possible someone is doing Something Nasty (tm).

Google the URL (or an interesting part of it) and see what you get - As an example, Code Red and Nimda's patterns were published all over the internet, so if you Googled the request you would often find a page talking about the worm that was harassing your (non-Windows) web server.
Also consider blocking the requesting address(es) if they're the same ones over and over again. If it's a legit user they'll complain. If not you will have cleaner logs.

share|improve this answer

\x is an escape sequence that can be used to represent any byte, though it's more commonly used to represent bytes that do not have an associated ASCII character.

So, the snippet that you posted in the title translates to, in bytes:

18 ba 4c 03 40 ea 24 03 48 5a 6d

What this means to your web service is completely dependent on how the web server and application handle this input.

share|improve this answer
    
It can't handle it I think but someone is up to something I found this on stackoverlow stackoverflow.com/questions/5202901/who-can-decode-this-code –  mashup Jul 25 '11 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.