Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations IamaSherpa on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Wierd access Log Entry

Status
Not open for further replies.

Prattaratt

Technical User
Aug 6, 2000
291
US
What is this? I was reviewing my access log and found a bunch of entries similar to this one:
181.69.198.217 - - [08/Jan/2013:13:12:23 -0600] "\xc2\xb4tC\xcb" 200 2411
 
Latin American IP + Odd URI access attempt === 'cracker' bot testing for exploits.


You should try and make it so requests like that send a 403 or 404 response NOT a 200 response, because a 200 response to that tells me that you are using a scripted response URL for "URL Not Found" responses, and there might be a weakness there.



Chris.

Indifference will be the downfall of mankind, but who cares?
Time flies like an arrow, however, fruit flies like a banana.
Webmaster Forum
 
I know that is an attempt to get into my site, and I should close the hole. Most of the attempts on my site do result in a 400 series response; this one got through. I wanted to know what the codes represent so I could figure how it was getting through and how to close that particular hole. I am assuming it is some kind of escaped byte code, but cannot pull up any info on it. Is it the PHP module, the HTTP module or something else?
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top