Strange webserver requests

Carnildo · Guru Joined: 17 Jun 2004 Posts: 595

I'm seeing the occasional request like "\x0e\x1a??|5ޥӯbz?1???\x91??\x8bɵJt??8?\x8c?P\x01o?dNeJ#d?|????\x0c??" (note: no GET or POST, just the bare string) in my webserver logs. I never see more than one from a given IP address, and I'm seeing about a half-dozen a day. Any idea what's going on?

ShadowCat8 · Posted: Tue Feb 23, 2010 6:35 pm Post subject:

Hmmm...

Well, my guesstimate would be that someone is trying to test for vulnerabilities on your webserver.

I just took a section of the string you posted above and put it into Google and got:
Mitigating the WASC Web Security Threat Classification with Apache and smbftpd 0.96 SMBDirList-function Remote Format String Exploit from milw0rm.

You may want to look at that first article as they do have some good ideas about fortifying apache.

HTH.
_________________
________________________

"As far as the laws of mathematics refer to reality, they are not
certain, and as far as they are certain, they do not refer to reality."

-- Albert Einstein