Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's one of the logged by nginx webserver requests:




Can someone understand what this is?

Thanks ;)

share|improve this question
up vote 0 down vote accepted

It may look like someone is fuzzing your webserver. Can you by any chance include more information than the strings you've pasted? It can look like someone is trying to pass you binary data.

There seems to be a pattern in some of it. For example \x may indicate hexadecimal annotation. You can see that both strings start and end with x11 and x1F. This might be of interest.

You also see an equal sign in there which may indicate the assigning of a GET value. Also the ampersand sign (&) which is used to concatenate several GET parameters.

Hopefully someone has a good explanation for us.

share|improve this answer
Yea i'm thinking the same. :) – Somebody Jun 3 '11 at 20:45

It seems encoding related. The second part seems to be octal-encoded with 'failsafe' guesswork done. How did you obtain the second part? A larger log chunk would help more.

share|improve this answer
Ugh... sorry. I was trying to fix some nginx log parser and it was crashing once in a while. Then i have decided to look into the problem and found those impossible to parse log strings. – Somebody Jun 3 '11 at 20:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.