Query: cross_site_scripting_html_injection

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  (
    request_uri is not null
    and (
      -- Common HTML tags that can be used for XSS
      request_uri ilike '%<iframe%src=%'
      or request_uri ilike '%<img%src=%' and (
          request_uri ilike '%onerror=%' 
          or request_uri ilike '%onload=%'
      )
      or request_uri ilike '%<svg%on%=' -- SVG with event handlers
      or request_uri ilike '%<svg><script%' -- SVG containing script
      or request_uri ilike '%<object%data=%' and request_uri not ilike '%application/pdf%'
      or request_uri ilike '%<embed%src=%' and request_uri not ilike '%application/pdf%'
      or request_uri ilike '%<video%src=%' and (
          request_uri ilike '%onerror=%' 
          or request_uri ilike '%onload=%'
      )
      or request_uri ilike '%<audio%src=%' and (
          request_uri ilike '%onerror=%' 
          or request_uri ilike '%onload=%'
      )
    )
  )
  or
  (
    http_user_agent is not null
    and (
      -- HTML tags with dangerous attributes (reduces false positives)
      http_user_agent ilike '%<iframe%src=%' 
      or http_user_agent ilike '%<iframe%srcdoc=%'
      or http_user_agent ilike '%<img%src=%' and (
          http_user_agent ilike '%onerror=%' 
          or http_user_agent ilike '%onload=%'
      )
      or http_user_agent ilike '%<svg%on%=' -- SVG with event handlers
      or http_user_agent ilike '%<svg><script%' -- SVG containing script
      or http_user_agent ilike '%<object%data=%' and http_user_agent not ilike '%application/pdf%'
      or http_user_agent ilike '%<embed%src=%' and http_user_agent not ilike '%application/pdf%'
      or http_user_agent ilike '%<video%src=%' and (
          http_user_agent ilike '%onerror=%' 
          or http_user_agent ilike '%onload=%'
      )
      or http_user_agent ilike '%<audio%src=%' and (
          http_user_agent ilike '%onerror=%' 
          or http_user_agent ilike '%onload=%'
      )
    )
  )
order by
  tp_timestamp desc;