Can someone shed light on this logs .

 ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx _TSM_HiddenField_=ctl00_ScriptManager1_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d4.1.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3aacfc7575-cdee-46af-964f-5d85d9cdcf92%3ade1feab2%3af9cec9bc%3aa0b0f951%3aa67c2700%3af2c8e708%3a720a52bf%3a4a2c8239%3a8613aea7%3a3202a5a2%3aab09e3fe%3a87104b7c%3abe6fb298 443 - Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C**

My question is

  1. is this XSS attack?
  2. What action did the user do that made the webserver to log these entries?
  3. if not an attack what these logs all about?
  • which part of the log entry is unexpected?
    – schroeder
    Dec 7, 2015 at 4:08
  • @neil smithline is this some kind of xss attack or a normal log entry.._TSM_HiddenField_=ctl00_ScriptManager1_HiddenField&_TSM_CombinedScripts_" .... for xss to happen you need to value of the TSM_HiddenField request parameter to be copied into a JavaScript string which is encapsulated in single quotation marks, which is missing in the logs. since the value is missing can i classify these as xss attack or normal one
    – MS Guy
    Dec 7, 2015 at 4:23
  • Is /list25/ADMN/Eligibility/EligibilityResponse.aspx a legitimate path / route in your application?
    – thexacre
    Dec 7, 2015 at 4:52
  • @thexacre 9 yes
    – MS Guy
    Dec 7, 2015 at 5:02

1 Answer 1


I did URL decode on the string you provided.This seems a normal log entry .Below are some of the things I could tell from the log entry:

  • The IP address who tried to browse to this page is on port 443 " to be honest I don't remember if this is one or the one at the start of the log entry, I need to look it up"

  • The browser submitted the following user agent header mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C**

  • The other part is just the URL with parameters being passed.

if that page is not usually visited by your users that might indicate an automated tool trying to specifically look for AJAX Control Toolkit ToolkitScriptManager.cs TSM_HiddenField Field XXS. You should inspect your logs looking for more evidence. You should look at the logs for the offending IP.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .