Query: cross_site_scripting_dom_based

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  (
    request_uri is not null
    and (
      -- DOM manipulation methods
      request_uri ilike '%document.getElementById%'
      or request_uri ilike '%document.querySelector%'
      or request_uri ilike '%document.write%'
      or request_uri ilike '%innerHTML%'
      or request_uri ilike '%outerHTML%'
      or request_uri ilike '%document.location%'
      or request_uri ilike '%window.location%'
      or request_uri ilike '%document.URL%'
      or request_uri ilike '%document.documentURI%'
      or request_uri ilike '%document.referrer%'
      or request_uri ilike '%window.name%'
      or request_uri ilike '%location.hash%'
      or request_uri ilike '%location.search%'
      or request_uri ilike '%location.href%'
    )
  )
  or
  (
    http_user_agent is not null
    and (
      -- DOM manipulation methods
      http_user_agent ilike '%document.getElementById%'
      or http_user_agent ilike '%document.querySelector%'
      or http_user_agent ilike '%document.write%'
      or http_user_agent ilike '%innerHTML%'
      or http_user_agent ilike '%outerHTML%'
      or http_user_agent ilike '%document.location%'
      or http_user_agent ilike '%window.location%'
      or http_user_agent ilike '%document.URL%'
      or http_user_agent ilike '%document.documentURI%'
      or http_user_agent ilike '%document.referrer%'
      or http_user_agent ilike '%window.name%'
      or http_user_agent ilike '%location.hash%'
      or http_user_agent ilike '%location.search%'
      or http_user_agent ilike '%location.href%'
    )
  )
order by
  tp_timestamp desc;