Query: sql_injection_error_based

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Error-based extraction patterns
    request_uri ilike '%convert%(%'
    or request_uri ilike '%cast%(%'
    or request_uri ilike '%extractvalue%(%'
    or request_uri ilike '%updatexml%(%'
    or request_uri ilike '%floor%(%'
    or request_uri ilike '%exp%(%'
    or request_uri ilike '%concat%(%'
    or request_uri ilike '%concat_ws%(%'
    or request_uri ilike '%group_concat%(%'
    -- Known error-based functions with database fingerprinting
    or request_uri ilike '%db_name%(%'
    or request_uri ilike '%@@version%'
    or request_uri ilike '%version%(%'
    or request_uri ilike '%pg_sleep%(%'
    or request_uri ilike '%sys.%'
    -- Common error triggers
    or request_uri ilike '%having%1=1%'
    or request_uri ilike '%order%by%'
    or request_uri ilike '%group%by%'
  )
order by
  tp_timestamp desc;