11

I'm running webserver on Debian8 64bit (2.6.32-042stab120.16) with Apache/2.4.10. Today in Apache access.log I found these entries:

164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\x01" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "USER test +iw test :Test Wuz Here" 400 0 "-" "-"
164.52.7.132 - - [26/Jun/2017:07:16:30 -0400] "GET / HTTP/1.1" 200 4191 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"l,

I'm aware that somebody is trying to test some vulnerabilities on my webserver. I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?

Should I do some more checks on this server?

Is this a known vulnerability? If yes, can I protect somehow from these kind of attacks?

Improve this question
2
  • I have the same 3 entries in my logs, also from an IP in Hong Kong. The \" in the middle of the string is interesting. I wonder if this is testing for a vulnerability.
    – Mat Gessel
    Nov 24, 2017 at 20:15
  • Yeah, I was wondering if these chars \” were something like an escape string for some function..? But I haven’t found more info on it. Nor have I noticed server compromise or data breach. How about you Mat? If you have more info feel free to comment or share as an answer on this topic
    – deevee
    Nov 25, 2017 at 19:54

1 Answer 1

Reset to default
13

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?

What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. content type (0x16 = handshake) followed by TLS version (0x0301 = TLS 1.0). Looks like somebody tried to speak HTTPS on port 80 instead of 443.

Improve this answer
2
  • Could this be considered as a probe by an adversary checking to see if you have SSL installed?
    – Rick
    Oct 24, 2020 at 18:35
  • 1
    @RickHenderson: It could, but it also could be a simple misconfiguration by the client. Or it could be that somebody published a URL as https://example.com:80 and the client just visited it. There is no actual evidence for an actual attack or probing here.
    – Steffen Ullrich
    Oct 24, 2020 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .