I use a WAF that monitors suspicious query string and form POST values. Typical script-kiddie stuff like common SQL injection strings, etc.

Over the last several months I've noticed a dramatic uptick in query strings that have this sequence of 4 characters appended to the usual (i.e. 'normal') querystring values:


If I have a page that passes three parameters (e.g. a, b and c) , I will see these entries in the webserver logs all at the same time (within 1 second):

GET   pagename  ?a=123&b=456&c=789
GET   pagename  ?a=123'[0]&b=456&c=789
GET   pagename  ?a=123&b=456'[0]&c=789
GET   pagename  ?a=123&b=456&c=789'[0]

So to me this looks like an automated tool looking for vulnerabilities, but I am trying to understand the significance of the string '[0]. Is this a known vector for some security issue out there? If so, I have not been able to find it. Is it just someone fuzzing the site? Or am I just missing something obvious here?

  • 3
    It's likely a way to attack a known flaw in some commonly used web application. The odds are this is an automated attack that is just hoping to get lucky by attacking as many sites as it can until it gets good results.
    – John Conde
    Jan 17, 2022 at 23:39
  • 1
    How are the URL parameters generated on your URLs? Are these hardcoded or the result of completing some form? Are these URL parameter values valid, apart from the erroneous '[0] suffix? Could this be a bug in your URL generation?
    – MrWhite
    Jan 18, 2022 at 1:56
  • @MrWhite: Some of these are logged with responses to forms, but most are embedded directly within the URL, even when it is the first URL logged from a specific IP address. So it's almost like some tool is grabbing search engine results and then inserting these '[0] strings hoping to find a common vulnerability. The reason I'm asking about it is they it seems to be pretty common now, but I've not seen it reported elsewhere as a common attack vector (e.g. like ' or 1=1 or any of the other common script-kiddy attempts). I'd like to know a bit more before I add it to the WAF's filter list. Jan 18, 2022 at 11:59
  • @JohnConde: I agree. I believe it to be an automated tool looking for vulnerabilities. I am trying to understand if this is a known vulnerability that needs to be added to my WAF's filters, or if this represents something else, entirely. Jan 18, 2022 at 12:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.