How do I install the Detecting SQL Injection Via Waf Logs skill?

Run npx skillmds add thedixitjain/detecting-sql-injection-via-waf-logs in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Detecting SQL Injection Via Waf Logs safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Detecting SQL Injection Via Waf Logs?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Detecting SQL Injection Via Waf Logs free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Detecting SQL Injection Via Waf Logs?

thedixitjain (@thedixitjain) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Detecting SQL Injection Via Waf Logs by thedixitjain

Name: Detecting SQL Injection Via Waf Logs
Rating: 4.2 (5 reviews)
Author: thedixitjain

Detecting SQL Injection Via Waf Logs

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.

thedixitjain 1ede1f3 4 files · 24.2 KB Updated Sep 9, 2026 2 repo stars

File contents

Detecting SQL Injection via WAF Logs

When to Use

When investigating security incidents that require detecting sql injection via waf logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Collect WAF logs (ModSecurity audit log, AWS WAF JSON logs, or Cloudflare firewall events).
Run the agent to parse and analyze:
- Detect SQLi payloads via 15+ regex patterns
- Classify attacks by OWASP injection type (classic, blind, time-based, UNION-based)
- Identify persistent attackers by IP clustering
- Correlate multi-request injection campaigns
- Calculate attack success probability based on response codes

python scripts/agent.py --log-file /var/log/modsec_audit.log --format modsecurity --output sqli_report.json

Examples

ModSecurity SQLi Detection

Rule 942100 triggered: SQL Injection Attack Detected via libinjection
URI: /api/users?id=1' UNION SELECT username,password FROM users--
Source IP: 203.0.113.42 (47 requests in 5 minutes)
Classification: UNION-based SQLi campaign

Source: mukul975/Anthropic-Cybersecurity-Skills → skills/detecting-sql-injection-via-waf-logs/SKILL.md

---name: detecting-sql-injection-via-waf-logsdescription: Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.--- # Detecting SQL Injection via WAF Logs ## When to Use - When investigating security incidents that require detecting sql injection via waf logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Familiarity with security operations concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities ## Instructions 1. Install dependencies: `pip install requests` 2. Collect WAF logs (ModSecurity audit log, AWS WAF JSON logs, or Cloudflare firewall events). 3. Run the agent to parse and analyze: - Detect SQLi payloads via 15+ regex patterns - Classify attacks by OWASP injection type (classic, blind, time-based, UNION-based) - Identify persistent attackers by IP clustering - Correlate multi-request injection campaigns - Calculate attack success probability based on response codes ```bash python scripts/agent.py --log-file /var/log/modsec_audit.log --format modsecurity --output sqli_report.json ``` ## Examples ### ModSecurity SQLi Detection ``` Rule 942100 triggered: SQL Injection Attack Detected via libinjection URI: /api/users?id=1' UNION SELECT username,password FROM users-- Source IP: 203.0.113.42 (47 requests in 5 minutes) Classification: UNION-based SQLi campaign ``` --- **Source:** [`mukul975/Anthropic-Cybersecurity-Skills`](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) → `skills/detecting-sql-injection-via-waf-logs/SKILL.md`

Frequently asked questions