Incidents
Re: \x HTTP requests Nov 09 2006 07:29PM
Neil Dickey (neil geol niu edu)
"Maxime Ducharme" <mducharme (at) cybergeneration (dot) com [email concealed]> wrote:

>I see these HTTP request and I'm looking for more information :
>[ ... ]
>x.x.x.3 - - [08/Nov/2006:05:06:21 -0500] "\x80|\x01\x03\x01" 200 8 "-" "-"
>
>Would it be someone attempting to send https request on my port 80 ?

When I see things like that in my logs it's generally a buffer
overflow attack, or something like that, but the entry will be
a great deal longer. What's really interesting to me about
your log excerpt is that your webserver successfully filled
the request, whatever it was -- that's what the " 200 " code
means.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115

------------------------------------------------------------------------
------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com
------------------------------------------------------------------------
------

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus