LogWatch: "possible successful probes"?

Quip11 · 07-19-2009, 11:41 AM

I saw this in my log this morning:

A total of 1 sites probed the server
adsl-76-197-246-151.dsl.chcgil.sbcglobal.net
A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that indicate a possible exploit):
null HTTP Response 200

In my access_log, the corresponding line was

adsl-76-197-246-151.dsl.chcgil.sbcglobal.net - - [18/Jul/2009:09:55:00 -0600] "\x13\xc6\xc85!\xfd\x1aI\x95\xac\x1b\xf2k\xa2u\x1c:X\x9b" 200 4094 "-" "-"

Just as Capt_Caveman suggested, 4094 is the length of my index.html file. But what's with the hex codes from Chicago?

-Q

// Welcome back after five years ;-p Your post was pruned from a vintage 2005 thread because necroposting, e.g, the practice of responding to a thread that died out long ago, should be avoided. It is best practice to create your own thread and if necessary add a reference to the original.

anomie · 07-20-2009, 04:39 PM

Quote:

Originally Posted by Quip11

In my access_log, the corresponding line was

adsl-76-197-246-151.dsl.chcgil.sbcglobal.net - - [18/Jul/2009:09:55:00 -0600] "\x13\xc6\xc85!\xfd\x1aI\x95\xac\x1b\xf2k\xa2u\x1c:X\x9b" 200 4094 "-" "-"

Just as Capt_Caveman suggested, 4094 is the length of my index.html file. But what's with the hex codes from Chicago?

My WAG here is someone is relying on an exploit that tricks a web server into accepting a (normally bad) request in hex.

A quick google for "web server hex attack" seemed to return a few relevant possibilities (which I didn't look at it in detail).