The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql injection.

The decoded value of the request string is

/?gclsrc=aw.ds&gclsrc=aw.ds& and 1>1

I can see

  • a duplicate gclsrc parameter
  • an sql injection attempt

... but why this combination? Is it a technique to grab adsense revenues while sqli probing?

  • 2
    The first part is called HTTP Parameter Pollution (HPP) and the second part a SQL injection in order to generate one or more errors. HPP can be used to bypass web application firewalls (which in this scenario is not the case) – Jeroen - IT Nerdbox Apr 9 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.