What is the intent behind these unknown HTTP Requests into my AWS Web Server?

Question

I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me.

I figured out so far that those requests aren't really an issue for my Development Flask Webserver, but I am curious what they are trying to do. The .env etc. are obvious, but what is the mechanic that these cryptic requests are trying to make use of? I assume some sort of special character code injection?

18.217.166.80 - - [01/Aug/2022 08:55:40] "POST /DAB_Webhook HTTP/1.1" 200 -
13.58.232.148 - - [01/Aug/2022 08:55:41] "POST /DAB_Webhook HTTP/1.1" 200 -
135.125.244.48 - - [01/Aug/2022 09:30:07] "POST / HTTP/1.1" 200 -
135.125.244.48 - - [01/Aug/2022 09:30:07] "GET /.env HTTP/1.1" 404 -
23.224.186.78 - - [01/Aug/2022 09:31:23] code 400, message Bad HTTP/0.9 request type ('\x16\x03\x01\x00±\x01\x00\x00\xad\x03\x03ÜZɦíPgTÿ\x91\x14Îó\x86\x98¹}#ö\x96\x8eùÕ\x1a.\x9e©G)\x88Þ<\x00\x00\x1aÀ/À+À\x11À\x07À\x13À')
23.224.186.78 - - [01/Aug/2022 09:31:23] "±­ÜZɦíPgTÿÎó¹}#öùÕ.©G)Þ<À/À+ÀÀÀÀ     ÀÀ" HTTPStatus.BAD_REQUEST -
23.224.186.78 - - [01/Aug/2022 09:31:36] "GET / HTTP/1.1" 200 -
23.224.186.78 - - [01/Aug/2022 09:31:38] "GET /favicon.ico HTTP/1.1" 404 -
23.224.186.78 - - [01/Aug/2022 09:31:40] "GET /robots.txt HTTP/1.1" 404 -
23.224.186.78 - - [01/Aug/2022 09:31:42] "GET /sitemap.xml HTTP/1.1" 404 -
163.123.143.71 - - [01/Aug/2022 09:49:10] "POST /boaform/admin/formLogin HTTP/1.1" 404 -
95.214.235.205 - - [01/Aug/2022 10:25:47] "GET /.env HTTP/1.1" 404 -
95.214.235.205 - - [01/Aug/2022 10:25:47] "POST / HTTP/1.1" 200 -
109.237.103.38 - - [01/Aug/2022 10:44:15] "GET /.env HTTP/1.1" 404 -
109.237.103.38 - - [01/Aug/2022 10:44:15] code 400, message Bad request version ("a\x00V\x13\x02\x13\x03\x13\x01À,À0À+À/̨̩\x00\x9f\x00\x9e̪À¯À\xadÀ®À¬À$À(À#À'À")
109.237.103.38 - - [01/Aug/2022 10:44:15] "C?ýO~kat·F×$o»Ê;/ï^hth ãÂiõm ÉîÉüxÒR°¾ÊºäjhMÀ¨Þ=¿Vå°
                                                                                               aVÀ,À0À+À/̨̩̪À¯À­À®À¬À$À(À#À'À" HTTPStatus.BAD_REQUEST -
5.58.83.153 - - [01/Aug/2022 10:44:56] "GET / HTTP/1.1" 200 -
135.125.244.48 - - [01/Aug/2022 11:00:09] "POST / HTTP/1.1" 200 -
135.125.244.48 - - [01/Aug/2022 11:00:09] "GET /.env HTTP/1.1" 404 -
185.220.101.176 - - [01/Aug/2022 11:07:55] "GET http://169.254.169.254/latest/meta-data/ HTTP/1.1" 404 -
185.196.220.70 - - [01/Aug/2022 11:41:26] "GET / HTTP/1.1" 200 -

Answer 1

These are just a series of bytes, the actual ASCII/Unicode representation like C?ýO~kat·F× doesn't matter so that's why it looks gibberish.

A series of bytes could be for many things, few examples:

• shellcode injection attempt, where these bytes could be specific Assembly instructions for return oriented programming to open a reverse shell back to the attacker or execute some commands. See an example buffer overflow exploit with a shellcode: https://www.exploit-db.com/exploits/802
• service fingerprinting, some services (like mysql) can have bugs that behave in a very specific way if you provide a specific input, ƒor example it crashes on negative numbers. This behavior can help determine the version of the listening service, for example if it crashes then we know it's above version X when the bug was introduced, but below version Y when it was fixed.

Usually PHP/JS shellcodes are at least partially human readable to make sense for the interpreter <?php ... ?>. Also given that the actor is fetching sitemap.xml, robots.txt, etc URIs it seems they are still in a recon phase just gathering information. My wild guess is they are fingerprinting a database through a HTML form, looking for it to return some specific error message. 400 bad requests indicates it was unsuccessful so I wouldn't be worried, the 200 successful or 500 server error response codes would be more worrying but still not a clear evidence of success.