Bizarre HTTP request

Question

Bizarre HTTP request

development

I've just found the following in my Apache logs:

24.4.226.247 - - [29/Jun/2007:15:30:23 -0400] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 404 305 "-" "-" "-"
24.4.226.247 - - [29/Jun/2007:15:30:25 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x
04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0
4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04
H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H
\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\
x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x
04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0
4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04
H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H
\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H[truncated significantly]

Does anybody know what this request is supposed to achieve? It's several screens of these x04h and x90 characters, so DoS seems the most likely, yet it's a one-off thing.

2 Replies

forum:pclissold · Answer 1 · June 29, 2007, 6:35 p.m.

forum:pclissold 17 years, 4 months ago

It's an IIS attack - from either Nimda or Code Red - I don't remember which.

forum:Ciaran · Answer 2 · June 30, 2007, 4:52 p.m.

forum:Ciaran 17 years, 4 months ago

It's a scan for unpatched IIS machines. The requests are crafted such that IIS chokes on them and returns stuff it shouldn't, and it possibly executes code in the URL that it shouldn't, too.

Since you're using Apache, you can ignore those.

Compute

Storage

Networking

Databases

Services

Developer Tools

Industries

Pricing

Community

Engage With Us

Bizarre HTTP request

2 Replies

Reply

Tips: