Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

It's one of the logged by nginx webserver requests:

‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F

or

\213\x11\303\273=\237&g\374\265\177\243\301\243x\254\270\220\300\311\365P\311uN0\346\333\266@Oc[\235\336m\236C\224\334\231\x04\273c/\213\x1F

Can someone understand what is this?

Thanks ;)

share|improve this question

2 Answers

up vote 0 down vote accepted

It may look like someone is fuzzing your webserver. Can you by any chance include more information than the strings you've pasted? It can look like someone is trying to pass you binary data.

There seems to be a pattern in some of it. For example \x may indicate hexadecimal annotation. You can see that both strings start and end with x11 and x1F. This might be of interest.

You also see an equal sign in there which may indicate the assigning of a GET value. Also the ampersand sign (&) which is used to concatenate several GET parameters.

Hopefully someone has a good explanation for us.

share|improve this answer
Yea i'm thinking the same. :) – Somebody Jun 3 '11 at 20:45
up vote 0 down vote

It seems encoding related. The second part seems to be octal-encoded with 'failsafe' guesswork done. How did you obtain the second part? A larger log chunk would help more.

share|improve this answer
Ugh... sorry. I was trying to fix some nginx log parser and it was crashing once in a while. Then i have decided to look into the problem and found those impossible to parse log strings. – Somebody Jun 3 '11 at 20:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.