2

It's one of the logged by nginx webserver requests:

‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F

or

\213\\x11\303\273=\237&g\374\265\177\243\301\243x\254\270\220\300\311\365P\311uN0\346\333\266@Oc[\235\336m\236C\224\334\231\\x04\273c/\213\\x1F

Can someone understand what this is?

Thanks ;)

1

It may look like someone is fuzzing your webserver. Can you by any chance include more information than the strings you've pasted? It can look like someone is trying to pass you binary data.

There seems to be a pattern in some of it. For example \x may indicate hexadecimal annotation. You can see that both strings start and end with x11 and x1F. This might be of interest.

You also see an equal sign in there which may indicate the assigning of a GET value. Also the ampersand sign (&) which is used to concatenate several GET parameters.

Hopefully someone has a good explanation for us.

  • Yea i'm thinking the same. :) – Somebody Jun 3 '11 at 20:45
0

It seems encoding related. The second part seems to be octal-encoded with 'failsafe' guesswork done. How did you obtain the second part? A larger log chunk would help more.

  • Ugh... sorry. I was trying to fix some nginx log parser and it was crashing once in a while. Then i have decided to look into the problem and found those impossible to parse log strings. – Somebody Jun 3 '11 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.