Query: path_traversal

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Directory traversal sequences
    request_uri ilike '%../%'
    or request_uri ilike '%..\\%'
    or request_uri ilike '%/./%'
    or request_uri ilike '%\\.\\%'
    or request_uri ilike '%/.%'
    or request_uri ilike '%\\\\%'
    -- Most common exploits
    or request_uri ilike '%../..%'
    or request_uri ilike '%../../../%'
    or request_uri ilike '%../../../../%'
    or request_uri ilike '%..//%'
    or request_uri ilike '%../../../../../../../../%'
    -- Bypass techniques
    or request_uri ilike '%..;/%'
    or request_uri ilike '%..///%'
  )
order by
  tp_timestamp desc;