Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Well someone is requesting some URL's with really strange hex codes.

How can I find out what they are up to. The problem is I don't even know what code that is, it's not a hex code.

How can I find out what's going on here?

share|improve this question
I guess this could be some form of buffer overflow exploit - but not really sure what I can do about it – mashup Jul 25 '11 at 15:19
up vote 1 down vote accepted

If it's definitely not something you'd expect for your application it is entirely possible someone is doing Something Nasty (tm).

Google the URL (or an interesting part of it) and see what you get - As an example, Code Red and Nimda's patterns were published all over the internet, so if you Googled the request you would often find a page talking about the worm that was harassing your (non-Windows) web server.
Also consider blocking the requesting address(es) if they're the same ones over and over again. If it's a legit user they'll complain. If not you will have cleaner logs.

share|improve this answer

\x is an escape sequence that can be used to represent any byte, though it's more commonly used to represent bytes that do not have an associated ASCII character.

So, the snippet that you posted in the title translates to, in bytes:

18 ba 4c 03 40 ea 24 03 48 5a 6d

What this means to your web service is completely dependent on how the web server and application handle this input.

share|improve this answer
It can't handle it I think but someone is up to something I found this on stackoverlow – mashup Jul 25 '11 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.