Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I found this in my logs earlier today:

174.0.111.178 - - [17/Feb/2013:17:39:49 -0900] "k\x8a4\x8f\x9f\x1c\xfb\xb9\xf4\xb8\x97CI\xa3w\xeb\xf9\xb2\xb4\b\xb9\x04\x05\xe1M\x88C\xde\xed<\x13\b\xfd\b\x9d\xb047\xe5k\x87\r\xc6\x1a\xab\x16b" 400 301 "-" "-"

Also this from the error log (same request):

[Sun Feb 17 17:39:49 2013] [error] [client 174.0.111.178] Invalid URI in request k\x8a4\x8f\x9f\x1c\xfb\xb9\xf4\xb8\x97CI\xa3w\xeb\xf9\xb2\xb4\b\xb9\x04\x05\xe1M\x88C\xde\xed<\x13\b\xfd\b\x9d\xb047\xe5k\x87\r\xc6\x1a\xab\x16b

Does anyone know what that means? I think its some kind of hex code or something but just was interested because I get one of these every few days or so, and also if it was potentially dangerous.

share|improve this question
1  
That could be shellcode (i.e., an attack on the server). Update, check security measures. –  vonbrand Feb 19 '13 at 3:47

1 Answer 1

up vote 2 down vote accepted

They are non-printable characters in the HTTP request. It could be someone trying to exploit your server or as harmless as a request containing multi-byte unicode characters.

The Apache mod_log_config manual explains the format:

For security reasons, starting with version 2.0.46, non-printable and other special characters in %r, %i and %o are escaped using \xhh sequences, where hh stands for the hexadecimal representation of the raw byte.

share|improve this answer
    
Ah thanks that makes more sense now. –  user160606 Feb 19 '13 at 5:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.