Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Chris Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

HTTP Method "SEARCH"?

Status
Not open for further replies.

Kirsle

Programmer
Jan 21, 2006
1,179
US
I was just checking my server access logs, and I see a lot of entries like this:

Code:
68.61.251.236 - - [21/Nov/2006:14:44:27 -0500] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02...\x90\x90\x90\x90...

I have Comcast cable Internet and Comcast IP addresses begin with 68.61, so this seems to be a fellow Comcast source. It seems to be connecting to my IP on port 80 and using method "SEARCH" followed by tons and tons of \x escape codes. It takes up 32 lines in Notepad with word wrap off, so the request goes the longest length Notepad allows on a single line and then wraps back around 32 times.

Is this a normal HTTP request, or does it look like some kind of a hacking attempt, or is it maybe something Comcast does to ping its fellow IP addresses?

Thanks in advance.

-------------
Kirsle.net | Kirsle's Programs and Projects
 
This is an attempt at a Windows exploit - some WebDav vulnerability, I believe. Your server should be returning a 414 for these.
 
yep, 414 returned. thanks.

-------------
Kirsle.net | Kirsle's Programs and Projects
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top