The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql injection.

The decoded value of the request string is

/?gclsrc=aw.ds&gclsrc=aw.ds& and 1>1

I can see

  • a duplicate gclsrc parameter
  • an sql injection attempt

... but why this combination? Is it a technique to grab adsense revenues while sqli probing?

  • 3
    The first part is called HTTP Parameter Pollution (HPP) and the second part a SQL injection in order to generate one or more errors. HPP can be used to bypass web application firewalls (which in this scenario is not the case) – Jeroen - IT Nerdbox Apr 9 at 22:41

This could be an initial control test for blind aw injection also Typically those start with a true/false test

So perhaps they are testing 1>1

Which is always false

Then they will also test 1=1

Which is always true

And look for a difference in the response


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.