5

I've been getting a couple of strange GET requests on my dev server from unknown IPs. I don't know if this is some weird character encoding or something entirely else. The mysterious thing is, my server responds with the status 200, so the input matches something, but I don't know what.

The request is ":\xcc\x89\xa9L\xcf\xc3\xb6\xc1\x8f\xa9\xe7\xc0\xec\x16"

Ideas?

EDIT: Corrected the request, it wasn't a GET request, but still returns the root index page.

EDIT2: A new one just popped up:
xxx.xxx.xxx.xxx - - [20/Oct/2010:09:10:33 +0300] ";\x8e\xb0!\xa2\xa7\xe7\x11\xf1HX\xb6\x188|z\x9b\xac;z\x10\xafn\xd8*fD\x9d\xc1\x11I\x9a5\xe6\xcbu,\x8c\xd7\x84O[\xf7\xca\xe67\xe5\xba\x94\xdd.\xc0d\xd0} " 200 2085 "-" "-"
Nope, definitely not unicode anymore...

5 Answers 5

2

Maybe a WebDAV hack similar to:

http://www.sans.org/security-resources/malwarefaq/webdav-exploit.php

Trying to exploit a buffer overrun.

1
  • From what I understand, these require one to still use WebDAV commands, not just the bytecode (or whatever the correct term might be). These requests have no command part, just the weid, unicode-ish characters. But it could be some new kind of buffer overrun attack however. Oct 20, 2010 at 6:26
1

It could just be someone attempting to exploit your system. What is your server's response to the request ?

2
  • The response code is 200, size 2085, how can I find out more? I Tried to replicate the request with nc but all I get is 400 Bad Request... Oct 19, 2010 at 9:57
  • Nevermind, got it, it gives the root index page... Oct 19, 2010 at 10:00
0

Do you use SSL?

Access log like a request trying to talk SSL on a non-SSL.

1
  • No, ssl is not in use on this server. Oct 19, 2010 at 9:06
0

Except for the third token, it looks like unicode character codes.

2
  • That's what I thought too, but couldn't find any way to verify, especially since \xa9L seems a bit odd... Oct 19, 2010 at 10:13
  • I agree on the \xa9L. You can translate the other characters on this site: unicodelookup.com/#0xcc/1
    – Benoit
    Oct 19, 2010 at 10:23
0

This certainly does not look like a valid HTTP request (could be an attempted attack.)

FWIW, my server (Apache 2.2.14) responds with "501 Method Not Implemented", which is its standard response to any request it does not recognize.

Is your server configured to rewrite anything it does not like to "/index.html" or some such?

1
  • No, no general rewrites are used, and certainly not to the root index. All rewrites are specific to their directories and applications. Oct 19, 2010 at 10:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .