1

I have received some weird request URL in my TOMCAT access logs. which is as follows:-

\x16\x03\x01\x01\"\x01" 200 40788

as clearly seen from above log, the server has given 200(success) response to the client(the one who is accessing above URL from our server).

I am really concerned whether the hacker is trying to post some malicious data on the server?

above request is in which format? is it in hexadecimal? how should I convert above request URL to text format so that I will get to know which resource he is trying to access or on which URL he is trying to post?

4

\x16\x03\x01...

This is the start of a TLS 1.0 ClientHello, i.e. the begin of a TLS handshake. The \x16 is the TLS record type 22 (hex 16 is decimal 22) which means handshake. The next two bytes are the major and minor SSL/TLS version of the record, where 03 01 stands for TLS 1.0. Probably somebody tried to access your HTTP site with HTTPS. It's not an attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.