1

I have received some weird request URL in my TOMCAT access logs. which is as follows:-

\x16\x03\x01\x01\"\x01" 200 40788

as clearly seen from above log, the server has given 200(success) response to the client(the one who is accessing above URL from our server).

I am really concerned whether the hacker is trying to post some malicious data on the server?

above request is in which format? is it in hexadecimal? how should I convert above request URL to text format so that I will get to know which resource he is trying to access or on which URL he is trying to post?

1 Answer 1

4

\x16\x03\x01...

This is the start of a TLS 1.0 ClientHello, i.e. the begin of a TLS handshake. The \x16 is the TLS record type 22 (hex 16 is decimal 22) which means handshake. The next two bytes are the major and minor SSL/TLS version of the record, where 03 01 stands for TLS 1.0. Probably somebody tried to access your HTTP site with HTTPS. It's not an attack.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .