1685 posts Time is what you desire most, but waste carelessly.
  • Sold between 100 000 and 250 000 dollars
  • Elite Author
  • Bought between 50 and 99 items
  • Referred between 100 and 199 users
  • Grew a moustache for the Envato Movember competition
  • Exclusive Author
  • Has been a member for 4-5 years
  • Envato Studio (Microlancer) Beta Tester
  • Europe
+1 more
Firsh says

I have some bad requests (400) in my apache error logs, from random IP addresses and all of the time these are unreadable encoded characters starting with \x, but I don’t know what kind of encoding this is. It might be harmless but I want to know what they mean.

What the hell is this?

PS. I meant StRing encoding in the title.

Thanks

4335 posts
  • Beta Tester
  • Bought between 10 and 49 items
  • Community Moderator
  • Contributed a Blog Post
  • Contributed a Tutorial to a Tuts+ Site
  • Exclusive Author
  • Grew a moustache for the Envato Movember competition
+6 more
Reaper-Media Volunteer moderator says

I thought sting sounded cooler… :P Anyway corrected the title, and have no idea about the encoding :-)

1685 posts Time is what you desire most, but waste carelessly.
  • Sold between 100 000 and 250 000 dollars
  • Elite Author
  • Bought between 50 and 99 items
  • Referred between 100 and 199 users
  • Grew a moustache for the Envato Movember competition
  • Exclusive Author
  • Has been a member for 4-5 years
  • Envato Studio (Microlancer) Beta Tester
  • Europe
+1 more
Firsh says

I thought sting sounded cooler… :P Anyway corrected the title, and have no idea about the encoding :-)

I’m pretty sure I’ve seen it before. Something that represents the characters on a very low level, like the root of all encodings.. Maybe unmapped keys, or hex, or something extreme.

320 posts
  • Author had a File in an Envato Bundle
  • Bought between 1 and 9 items
  • Exclusive Author
  • Has been a member for 5-6 years
  • Sold between 1 000 and 5 000 dollars
  • United States
jwmcpeak says

Hex

1685 posts Time is what you desire most, but waste carelessly.
  • Sold between 100 000 and 250 000 dollars
  • Elite Author
  • Bought between 50 and 99 items
  • Referred between 100 and 199 users
  • Grew a moustache for the Envato Movember competition
  • Exclusive Author
  • Has been a member for 4-5 years
  • Envato Studio (Microlancer) Beta Tester
  • Europe
+1 more
Firsh says

Hex

And how do I convert it to ‘english’?

320 posts
  • Author had a File in an Envato Bundle
  • Bought between 1 and 9 items
  • Exclusive Author
  • Has been a member for 5-6 years
  • Sold between 1 000 and 5 000 dollars
  • United States
jwmcpeak says


Hex
And how do I convert it to ‘english’?

Sorry, I didn’t read the part where you wanted to know what it meant. I imagine the best way is an Apache log reader. There are a ton of those (and I don’t use Apache), so I don’t know what to recommend.

1685 posts Time is what you desire most, but waste carelessly.
  • Sold between 100 000 and 250 000 dollars
  • Elite Author
  • Bought between 50 and 99 items
  • Referred between 100 and 199 users
  • Grew a moustache for the Envato Movember competition
  • Exclusive Author
  • Has been a member for 4-5 years
  • Envato Studio (Microlancer) Beta Tester
  • Europe
+1 more
Firsh says



Hex
And how do I convert it to ‘english’?
Sorry, I didn’t read the part where you wanted to know what it meant. I imagine the best way is an Apache log reader. There are a ton of those (and I don’t use Apache), so I don’t know what to recommend.

Well I have AppServ (a server package for windows), and I open the read Apache Log. I don’t think there is any more to it than that file. It’s already very verbose listing every request that has been made. I cropped the screenshot but there are more information at the beginning of the lines like IP and time stamp. Majority of the requests are in plain english. But these are encrypted or I don’t know.

2953 posts
  • Australia
  • Community Moderator
  • Elite Author
  • Author had a Free File of the Month
  • Most Wanted Bounty Winner
  • Author had a File in an Envato Bundle
  • Has been a member for 5-6 years
  • Contributed a Blog Post
  • Repeatedly Helped protect Envato Marketplaces against copyright violations
+10 more
dtbaker Volunteer moderator says

looks similar to shell code.

i wouldn’t worry, there’s probably some new exploit out for a web server or software so automated bots are going around testing everyones website to see if they can break it.

102 posts
  • Author had a Free File of the Month
  • Bought between 100 and 499 items
  • Exclusive Author
  • Has been a member for 4-5 years
  • Referred between 1 and 9 users
  • Sold between 10 000 and 50 000 dollars
  • United Kingdom
RyanDavies says

looks a bit python(ish), no clue what it means though, sorry :(

7 posts
  • Has been a member for 0-1 years
dotancohen says

I’m late to the party, but let’s see if I can help.

The \x\x text is ostensibly hex-encoded something. That is, Apache got a sequence of bits which it represents as a series of two-byte (16 bit) codes. If they were all below \x80 it would be ASCII (which it isn’t). If they were all near each other numerically, then it would be some other encoding (which it isn’t). Since those numbers are all over the place, I’m guessing that it is one of two things:

1) Somebody attacking your server, possibly looking for a buffer overflow.

2) Somebody hitting an HTTP server with an HTTPS request on the HTTP port. This encrypted stream will not be encoded text and thus will look like random bits.

My guess is for the latter, just from looking at it.

I understand that it is a bit late to help the OP, but I figure if this page is showing up in search results then this answer may help somebody in the future.

by
by
by
by
by
by