Strange GET requests to my Apache Web Server?

Question

A few days ago, my Apache web server was hit with get requests, many of which had strange escape sequences. Can someone read the following sample log entries and explain what the person tried to do, and what measures can be taken to protect against this? Nothing was hacked yet, but I would still like to know the purpose of this.

Note that the source IP address and timestamps were intentionally obscured.

1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /signin.php\vZ\xae\t\xc1\xc8\xb9\x8d\xbd\xb4\xbd\xa9\x85\xd9\x85\xcd\x8d\xc9\xa5\xc1\xd0\xbd\x91\x91}\xb5\x95\xb9\xd4\xb9\xa9\xcc HTTP/1.1" 200 16174 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"    
1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /sig\xb2,\xde HTTP/1.1" 404 10139 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"    
1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /images/q2.gie\xa7\xb1\xb7\xf7, HTTP/1.1" 404 10175 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"
1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /images/q2.gie\xa2vices-search HTTP/1.1" 404 10175 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"
1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /m\xae\xe7 HTTP/1.1" 404 9145 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"
1.1.1.1 - - [19/Jun/2013:03:02:01 -0800] "GET /images/z.gif0\x89\xdba\xeb\xbe HTTP/1.1" 404 9199 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0" "-"

Thanks.

Answer 1

This looks like typical fingerprinting scans. Some tools send out odd requests to determine the type of server and firewalls you might have in place.

Try to replay those requests to see how your site responds and determine if there are changes you need to make to your environment to make it fail gracefully and consistently, if possible.

It is 'just' a probe, but I would put that IP on a watch list for further activity.

Answer 2

This is definitely interesting. I can think of a few possibilities:

1. This is nonsense and they are just trying to see how the webserver will respond to junk.
2. Some webservers may react badly to character encodings like this \vZ, \xc1 etc and they are seeing how yours will respond.
3. They are trying to detect if there's a web-app firewall or IPS fronting your web-app. A system like that might clean up requests or reject them outright which would give them clues.

I'm also curious why the first line is a 200 and the rest come back as 404. I would think that /signin.php\vZ... would fail. You should do some testing with that page to see why \vZ isn't failing.

In general if you are concerned about the security of your webserver you can make sure it's up to date with the latests versions or patches and ensure that it's not running with root privileges.

Answer 3

You can configure the Apache HTTPD and implement mod_security to filter out such attempts. Here's a nice post on doing that and a sample mod_security rule written that executes some code/script to further take action on an IP (source):

SecRule  REQUEST_URI_RAW "(/mail/bin/msgimport|/nonexisten****|/bin/msgimport|/rc/bin/msgimport|/webmail/bin/msgimport|w00tw00t.at.ISC.SANS.DFind|proxytest.pr.****.de)" " phase:2,t:none,t:lowercase,t:normalisePath,deny,log,status:404,exec:/usr/bin/shared/imr.sh,msg:'RoundCube Webmail scan from %{REMOTE_ADDR}.  Blocked.  More on RoundCube Webmail found at http://roundcube.net.  See site for possible further news on this.',id:99999"

However, mod security comes with it's own set of rules already configured so you might not need to do anything much after an installation.