为何 '[0] 近期频繁被追加至查询字符串末尾？

Great question—this '[0] pattern is actually super prevalent in automated scanning and exploit attempts, and it ties into a few specific attack vectors and tool behaviors. Let’s break down why you’re seeing it so often:

• PHP Array Parsing & Variable Coverage Tests
  A big reason this pops up is targeting PHP-based applications. In PHP, query parameters like param[0] get parsed into an array. But when attackers append '[0] to a normal string parameter (e.g., userid=123'[0]), they’re testing two things:

  • Whether the backend mishandles malformed array syntax (especially in older PHP setups or apps with poor input validation)
  • If unfiltered input can overwrite server-side variables or trigger unexpected array-related behaviors that lead to vulnerabilities like code execution or data leakage.

• SQL Injection Probe
  While '[0] isn’t a full SQL injection payload, it’s a clever reconnaissance test. Imagine a backend that directly interpolates parameters into SQL queries like:

  SELECT * FROM accounts WHERE id = '$user_id'
  

  Adding '[0] turns this into:

  SELECT * FROM accounts WHERE id = ''[0]'
  

  This triggers a SQL syntax error if the app doesn’t properly escape single quotes. Attackers use this to quickly check if the app is vulnerable to SQL injection—if they get an error response, they’ll follow up with more targeted payloads.

• Automated Scanner Default Payloads
  Most web vulnerability scanners (like Burp Suite, SQLMap, or open-source tools) include '[0] in their default probe lists. It’s a lightweight, low-effort test that can detect multiple weaknesses at once (SQLi, array parsing flaws, weak input filtering) without triggering overly aggressive WAF rules. Since these scanners run constantly across the web, you’ll see this pattern repeatedly from automated bot traffic.

• Rare Legitimate Edge Cases
  On rare occasions, this could come from a buggy frontend script (e.g., a JS loop accidentally appending array indices to parameters). But if you’re seeing it frequently across multiple parameters, it’s almost certainly automated attack traffic—not legitimate user behavior.

To sum up: '[0] isn’t an attack vector on its own, but it’s a reconnaissance tool attackers use to map out an app’s defenses. Once they confirm a weakness (like unescaped quotes or poor array handling), they’ll escalate to more dangerous payloads.

内容的提问来源于stack exchange，提问作者CodeWhisperer