I'm running webserver on Debian8 64bit (2.6.32-042stab120.16
) with Apache/2.4.10.
Today in Apache access.log
I found these entries:
164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\x01" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "USER test +iw test :Test Wuz Here" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "GET / HTTP/1.1" 200 4191 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"l,
I'm aware that somebody is trying to test some vulnerabilities on my webserver. I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?
Should I do some more checks on this server?
Is this a known vulnerability? If yes, can I protect somehow from these kind of attacks?
\"
in the middle of the string is interesting. I wonder if this is testing for a vulnerability.