Query: sql_injection_common_patterns

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Basic SQL commands
    request_uri ilike '%select%from%'
    or request_uri ilike '%insert%into%'
    or request_uri ilike '%delete%from%'
    or request_uri ilike '%update%set%'
    or request_uri ilike '%drop%table%'
    or request_uri ilike '%truncate%table%'
    or request_uri ilike '%create%table%'
    or request_uri ilike '%alter%table%'
    or request_uri ilike '%exec%xp_%'
    or request_uri ilike '%information_schema%'
    -- Common SQL injection patterns
    or request_uri ilike '%or%1=1%'
    or request_uri ilike '%or%true%'
    or request_uri ilike '%/*_%*/%'
    or request_uri ilike '%--+%'
    or request_uri ilike '%-- %'
    or request_uri ilike '%;--%'
    -- URL encoded variants
    or request_uri ilike '%\x27%'
    or request_uri ilike '%\x22%'
    or request_uri ilike '%\x3D\x3D%'
  )
order by
  tp_timestamp desc;