3 ms·
No, these 5528 attack vectors are not unique. What can be seen here is a repetition of a few attacks on different base paths, or with a different length of the
by patrakov 4y ago
No, these 5528 attack vectors are not unique. What can be seen here is a repetition of a few attacks on different base paths, or with a different length of the repetitive part of the request (e.g. GET /about/'+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526+--+).
- nibbleshifter 4y agoThe union select one with the repeated hex looks to me a lot like certain automated scanner tools trying to identify a column through which they can exfil the output of a SQL query.
- scandinavian 4y agoIt's just looking for the number of columns returned by the initial query. UNION queries have to return the same number of columns as the query they are added to.
- jwilk 4y agoFor context, the initial submission title was "From 7 Years of Apache HTTP Server Logs: 5528 Unique Recon and Attack Vectors".