Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My web server periodically comes under attack, and I get a bunch of requests that look like


Are there simple command line tools to decode this?

share|improve this question

closed as off-topic by Nathan C, TheCleaner, dawud, Tom O'Connor Aug 27 '13 at 20:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – TheCleaner, dawud, Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

Answered here:… – Greg Askew Aug 27 '13 at 18:06
@GregAskew: That question is asking what happened as a result of an attack. I'm looking for a tool to help me decode the various results. – chris Aug 27 '13 at 18:08
It's too bad a site like: doesn't exist yet. :) – TheCleaner Aug 27 '13 at 18:13
@chris: the top answer has the breakdown – Greg Askew Aug 27 '13 at 18:40

it appears to be the Havij SQL injection tool. The requests are trying to locate how many columns are in a particular table.

Please learn about preventing SQL injections and attacks like this won't even work.

share|improve this answer
I'm aware of Havij, and am very familiar with sql injection. But I can't find a simple tool to decode what ends up in the log. – chris Aug 27 '13 at 18:10
It's just hex. There's many tools online. The hex in question is just random characters (in hex) in order to get a column count. – Nathan C Aug 27 '13 at 18:11
Sure, but there are hundreds of request that use different techniques for obfuscating the actual request - I was hoping to be able to extract them from my logs, pipe them to a tool, and view the results. – chris Aug 27 '13 at 18:26
I'm not aware of any tool that does this...what you're asking is for a tool that can detect every possible request and decode them, which i don't believe is possible. You can use something like GreenSQL as a "proxy" to log and report malicious-like queries, but that's all I have. – Nathan C Aug 27 '13 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.