# SPDX-License-Identifier: AGPL-3.0-only
# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A SQL-injection probe in the query string ('union select',
# sleep(), information_schema…).
# Data from the CrowdSec hub (MIT). Matched in the query string only,
# case-insensitively, whatever the status: a request that SUCCEEDED
# with one of these in it is the worst case, not the innocent one.
parser: http-sqli-probe
log: http
prefilter_any:
  - "%40%40version"
  - "..xp_cmdshell"
  - "information_schema.tables"
  - "%20union%20all%20select%20"
  - "%20union%20select%20"
  - "%2cnull%2cnull"
  - "benchmark%28"
  - "load_file%28"
  - "substr%28"
  - "substring%28"
  - "selectchar%28"
  - "%7c%7cchr%28"
  - "distinct%28"
  - "pg_sleep%28"
  - "sleep%28"
  - "upper%28"
  - "hex%28"
  - "md5%28"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*(?i:%40%40version|\.\.xp_cmdshell|information_schema\.tables|%20union%20all%20select%20|%20union%20select%20|%2cnull%2cnull|benchmark%28|load_file%28|substr%28|substring%28|selectchar%28|%7c%7cchr%28|distinct%28|pg_sleep%28|sleep%28|upper%28|hex%28|md5%28)[^ "]*) [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
