Security Incidents mailing list archives
Re: \x HTTP requests
From: Neil Dickey <neil () geol niu edu>
Date: Thu, 9 Nov 2006 13:29:57 -0600 (CST)
"Maxime Ducharme" <mducharme () cybergeneration com> wrote:
I see these HTTP request and I'm looking for more information : [ ... ] x.x.x.3 - - [08/Nov/2006:05:06:21 -0500] "\x80|\x01\x03\x01" 200 8 "-" "-" Would it be someone attempting to send https request on my port 80 ?
When I see things like that in my logs it's generally a buffer overflow attack, or something like that, but the entry will be a great deal longer. What's really interesting to me about your log excerpt is that your webserver successfully filled the request, whatever it was -- that's what the " 200 " code means. Best regards, Neil Dickey, Ph.D. Research Associate/Sysop Geology Department Northern Illinois University DeKalb, Illinois 60115 ------------------------------------------------------------------------------ This List Sponsored by: Black Hat Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations. http://www.blackhat.com ------------------------------------------------------------------------------
Current thread:
- \x HTTP requests Maxime Ducharme (Nov 09)
- Re: \x HTTP requests Thierry Zoller (Nov 09)
- RE: \x HTTP requests ROPERT François (Nov 09)
- RE: \x HTTP requests Maxime Ducharme (Nov 09)
- Re: \x HTTP requests Richard Sammet (Nov 13)
- <Possible follow-ups>
- Re: \x HTTP requests Neil Dickey (Nov 09)