Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a standard asp.net 2.0 application running on IIS 6. I have noticed some strange exception messages in the logs. They seem to be caused by random spam bots trying to submit forms. They are strange because the request string is huge and all the exception details in the event manager are messed up, they have been replaced with %21,%22, etc.. as seen in the screen shot. Is this some kind of exploit or just a bug in the asp.net exception handler/logger ?

Exception

UPDATE: I traced the requests that are causing this strange log event to a bug in IE8 that causes it to request scriptresource.axd?d={html from page} as described in these links:

I am still not sure why these requests would break the IIS log event like seen above, they are just long strings of jiberish being sent to the server, maybe someone reading this can shed some light on it.

share|improve this question
    
The "% incrementing numbers" appear to be placeholders or index numbers to actual data that should be in place. I wonder if this is an exploit that even prevents this kind of logging to be disrupted. –  p.campbell Jul 20 '09 at 4:38

2 Answers 2

%nn is of course a character encoding - looks like an attempted exploit to me.

share|improve this answer

Have you tried capturing the exception inside your asp.net application rather than at Windows Event Log level? If you do this you should be able to get a better view of the real data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.