Skip to main content
GameDev.net gamedev.net
🔒 Locked

apache log

Started by CProgrammer Nov 3, 2010 at 1:13 PM 12 replies 3.9k views
Original Post
CProgrammer
CProgrammer
Most apache log entries have a GET followed by the url, i.e. http requests. I've just encountered an entry without the GET or HTTP suffix. It is simply \giberish\moregiberish.
Notice the backslashes instead of forward slashes so it is not even a directory structure.
Oddly the server returned 200, i.e. success, according to the logs.
Any ideas?

Thanks guys.

-CProgrammer
Sneftel
Sneftel
Was "gibberish" misspelled in the log file too, or was that a mistake in transcribing it here?
CProgrammer
CProgrammer
ipaddress - - [03/Nov/2010:13:48:19 -0400] "\x87\x83\xbbX3a" 200 3207 "-" "-"

That is the line in the file, I left out the actual IP.

Antheus
Antheus
These are 4 hex characters. Well, 3 at least, plus a malformed one.

\ indicates special character, x is hex, the next two bytes are hex value.

In ASCII, this doesn't really spell anything useful:"çâ╗:"
CProgrammer
CProgrammer
A mystery..
It's not an http request. I thought Apache only handled http. How does one create a request as above?
SimonForsman
SimonForsman
Quote:
Original post by CProgrammer
A mystery..
It's not an http request. I thought Apache only handled http. How does one create a request as above?


by opening a socket to port 80 and sending stuff, it might be an attempt to hack the server (There have been a few security flaws related to malformed requests in the past)
[size="1"]I don't suffer from insanity, I'm enjoying every minute of it.
The voices in my head may not be real, but they have some good ideas!
CProgrammer
CProgrammer
Since the 200 success return is an http return, im guessing this doesnt necessarily mean they got what they wanted?
CProgrammer
CProgrammer
Anyone have any ideas what the 200 return means in this case? And whether there are other indicators that could tell me if the attempt succeeded.

Thanks

Cprogrammer
Tachikoma
Tachikoma
Look up the IP address. Sometimes that can reveal some interesting information, such as whether it belongs to bot activity.
CProgrammer
CProgrammer
I looked up the IP and it comes from a large ISP in the US.
I'd like to try recreating the request but short of playing around with a socket library programmatically, I can't think of a way to do this. Is there an application that can do this, i.e. send some request to port 80.

-CProgrammer
CProgrammer
CProgrammer
Hi guys,

I was able to recreate the request and as expected 200 is simply a default return. There seems to be no inherent security risk, as I have all the newest patches. But these requests seem to be going around at the moment.

-CProgrammer

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.