Analyzes ModSecurity, AWS WAF, and Cloudflare logs to detect SQL injection attacks. Identifies patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks IP sources, associates multi-stage attempts, generates OWASP-classified reports.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
1. 安装依赖：`pip install requests`
Analyzes ModSecurity, AWS WAF, Cloudflare logs to detect SQLi campaigns. Identifies patterns (UNION SELECT, OR 1=1, SLEEP()), tracks attackers, correlates attempts, generates OWASP reports.
Analyzes ModSecurity, AWS WAF, and Cloudflare logs to detect SQL injection campaigns. Parses for patterns like UNION SELECT/OR 1=1/SLEEP, tracks IPs, correlates attempts, generates OWASP reports.
Parses Apache and Nginx access logs to detect SQL injection, LFI, directory traversal, web scanner fingerprints, and brute force using regex OWASP patterns, GeoIP enrichment, and request frequency anomalies.
Share bugs, ideas, or general feedback.
pip install requestspython scripts/agent.py --log-file /var/log/modsec_audit.log --format modsecurity --output sqli_report.json
Rule 942100 triggered: SQL Injection Attack Detected via libinjection
URI: /api/users?id=1' UNION SELECT username,password FROM users--
Source IP: 203.0.113.42 (47 requests in 5 minutes)
Classification: UNION-based SQLi campaign