5

I'm running webserver on Debian8 64bit (2.6.32-042stab120.16) with Apache/2.4.10. Today in Apache access.log I found these entries:

164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\x01" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "USER test +iw test :Test Wuz Here" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "GET / HTTP/1.1" 200 4191 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"l,

I'm aware that somebody is trying to test some vulnerabilities on my webserver. I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?

Should I do some more checks on this server?

Is this a known vulnerability? If yes, can I protect somehow from these kind of attacks?

  • I have the same 3 entries in my logs, also from an IP in Hong Kong. The \" in the middle of the string is interesting. I wonder if this is testing for a vulnerability. – Mat Gessel Nov 24 '17 at 20:15
  • Yeah, I was wondering if these chars \” were something like an escape string for some function..? But I haven’t found more info on it. Nor have I noticed server compromise or data breach. How about you Mat? If you have more info feel free to comment or share as an answer on this topic – d324223 Nov 25 '17 at 19:54
6

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?

What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. content type (0x16 = handshake) followed by TLS version (0x0301 = TLS 1.0). Looks like somebody tried to speak HTTPS on port 80 instead of 443.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.