5

I've been getting a couple of strange GET requests on my dev server from unknown IPs. I don't know if this is some weird character encoding or something entirely else. The mysterious thing is, my server responds with the status 200, so the input matches something, but I don't know what.

The request is ":\xcc\x89\xa9L\xcf\xc3\xb6\xc1\x8f\xa9\xe7\xc0\xec\x16"

Ideas?

EDIT: Corrected the request, it wasn't a GET request, but still returns the root index page.

EDIT2: A new one just popped up:
xxx.xxx.xxx.xxx - - [20/Oct/2010:09:10:33 +0300] ";\x8e\xb0!\xa2\xa7\xe7\x11\xf1HX\xb6\x188|z\x9b\xac;z\x10\xafn\xd8*fD\x9d\xc1\x11I\x9a5\xe6\xcbu,\x8c\xd7\x84O[\xf7\xca\xe67\xe5\xba\x94\xdd.\xc0d\xd0} " 200 2085 "-" "-"
Nope, definitely not unicode anymore...

2

Maybe a WebDAV hack similar to:

http://www.sans.org/security-resources/malwarefaq/webdav-exploit.php

Trying to exploit a buffer overrun.

  • From what I understand, these require one to still use WebDAV commands, not just the bytecode (or whatever the correct term might be). These requests have no command part, just the weid, unicode-ish characters. But it could be some new kind of buffer overrun attack however. – onik Oct 20 '10 at 6:26
1

It could just be someone attempting to exploit your system. What is your server's response to the request ?

  • The response code is 200, size 2085, how can I find out more? I Tried to replicate the request with nc but all I get is 400 Bad Request... – onik Oct 19 '10 at 9:57
  • Nevermind, got it, it gives the root index page... – onik Oct 19 '10 at 10:00
0

Do you use SSL?

Access log like a request trying to talk SSL on a non-SSL.

  • No, ssl is not in use on this server. – onik Oct 19 '10 at 9:06
0

Except for the third token, it looks like unicode character codes.

  • That's what I thought too, but couldn't find any way to verify, especially since \xa9L seems a bit odd... – onik Oct 19 '10 at 10:13
  • I agree on the \xa9L. You can translate the other characters on this site: unicodelookup.com/#0xcc/1 – Benoit Oct 19 '10 at 10:23
0

This certainly does not look like a valid HTTP request (could be an attempted attack.)

FWIW, my server (Apache 2.2.14) responds with "501 Method Not Implemented", which is its standard response to any request it does not recognize.

Is your server configured to rewrite anything it does not like to "/index.html" or some such?

  • No, no general rewrites are used, and certainly not to the root index. All rewrites are specific to their directories and applications. – onik Oct 19 '10 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.