Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: Weird Unicode? in web log |
|
| Author |
|
PremiumSaltine
Joined: 13 Jul 2012
Posts: 3
Location: USA, WA
|
 Posted: Fri 13 Jul '12 20:13 Post subject: Weird Unicode? in web log |
 |
|
In my Apache logs, I'm getting a bunch of Unicode URL's showing up and I don't know why. I can't find any information on it and I'm wondering if I've been hacked or something.
178.120.48.59 - - [07/13/2012 12:13:53 AM] "!\x91Kw(\x9d\xe0\x05\xf3\x16\xd0s" 200 6517 "-" "-"
112.204.39.45 - - [07/13/2012 01:23:00 AM] "\xb8K/\xbdH\xbc\x18\x9aUo\xbc\x19\x07R" 200 6517 "-" "-"
64.13.161.89 - - [07/13/2012 03:59:21 AM] "\xb4\xb3^\x80I\x8d" 200 6517 "-" "-"
50.76.54.228 - - [07/13/2012 07:00:10 AM] "5\xe8)\x90\xd8\xf1J\xb2\x93\x16o\xd0\xc4e+3\x9d.\xce\xfd\xbc\xb8}\xf0\xc2\xd4\xc7\xe1$8\xde\xe0\xf6+\xc0I\xf6\xa7!\xa9\x91\xca\xc8\xb2" 200 6517 "-" "-"
Can somebody tell me what is happening please? I'm really worried about this. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7371
Location: Germany, Next to Hamburg
|
| Posted: Sat 14 Jul '12 11:45 Post subject: |
|
|
Someone tried to insert shellcode. If that is a harm for you depends if you have an application that sends those code to your OS.
For some users here at apachelounge mod_security is their protection. |
|
| Back to top |
|
PremiumSaltine
Joined: 13 Jul 2012
Posts: 3
Location: USA, WA
|
| Posted: Sat 14 Jul '12 21:33 Post subject: |
|
|
| I tried mod_security2 and it didn't seem to do anything at all to stop this. |
|
| Back to top |
|
PremiumSaltine
Joined: 13 Jul 2012
Posts: 3
Location: USA, WA
|
| Posted: Sun 15 Jul '12 5:09 Post subject: |
|
|
| I got it off this site and set it up exactly like the readme. Is there some special config I need to add to get it to block this? Or at least show it as a 404 or something. The 200 code is the main thing bothering me. It makes it seem like the attacks are getting through. |
|
| Back to top |
|
|
|
|
|
|
