I recently spun up a web server and have been receiving hits where the client appends a random number, for example "12345" as a query string to the root (/) endpoint.

Here's an example log entry:

12345/678910.111, [response], get / {"89671":""} 200 (10ms)

This seems like a purposeful exploit but I have no idea what to make of it. Does this match up against a known exploit, and if so, what?

  • You are going to get a lot of seemingly random garbage being requested. Is there something specific that you are concerned about? – schroeder Jul 3 '15 at 21:04
  • Just general curiosity. It's like trawling the deep ocean floor and sifting through what you scoop up. – Max Shenfield Jul 5 '15 at 5:16

I would guess this is a spider doing cache busting. The get parameter is ignored by the server and client, but since the get parameters are part of the url (as far as the caches are concerned) the url has never been seen before, so it forces a fresh load from the web server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.