Query: encoded_path_traversal

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- URL encoded traversal sequences
    request_uri ilike '%..%2f%'
    or request_uri ilike '%..%2F%'
    or request_uri ilike '%..%5c%'
    or request_uri ilike '%..%5C%'
    or request_uri ilike '%%2e%2e%2f%'
    or request_uri ilike '%2e%2e/%'
    or request_uri ilike '%2e%2e%2f%'
    or request_uri ilike '%2e%2e%5c%'
    -- Double URL encoding
    or request_uri ilike '%%252e%252e%252f%'
    or request_uri ilike '%%252e%252e%255c%'
    -- Unicode/UTF-8 encoding
    or request_uri ilike '%..%c0%af%'
    or request_uri ilike '%..%e0%80%af%'
    or request_uri ilike '%..%c1%1c%'
    or request_uri ilike '%..%c1%9c%'
    -- Overlong UTF-8 encoding
    or request_uri ilike '%..%c0%2f%'
    or request_uri ilike '%..%c0%5c%'
    or request_uri ilike '%..%c0%80%af%'
    -- Hex-encoded
    or request_uri ilike '%2e2e2f%'
    or request_uri ilike '%2e2e5c%'
  )
order by
  tp_timestamp desc;