['flow', 'http']
src_ip: 172.16.0.1, src_port: 36208, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 5, flow_pkts_toclient: 5, flow_bytes_toserver: 874, flow_bytes_toclient: 2178, flow_age: 5, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/sqli/?id=1%27+and+1%3D1%23&Submit=Submit, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+user%2C+password+from+users%23&Submit=Submit, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0
The network event indicates a Web Attack - SQL Injection. SQL injection attacks involve injecting malicious SQL queries into web application inputs to manipulate the backend database. Typically, the logs show HTTP requests with suspicious SQL keywords or patterns aiming to manipulate the backend database. These requests often contain unusual query strings with characters like single quotes, double quotes, semicolons, and SQL keywords such as `SELECT`, `INSERT`, `UPDATE`, `DELETE`, and `UNION`. Additionally, the logs may show multiple anomalies indicating SQL errors or unexpected database responses. This behavior is consistent with SQL injection attacks, which aim to exploit vulnerabilities in web application inputs to execute unauthorized SQL commands.
classification: Attack
justification: The network event indicates a Web Attack - SQL Injection. SQL injection attacks involve injecting malicious SQL queries into web application inputs to manipulate the backend database. Typically, the logs show HTTP requests with suspicious SQL keywords or patterns aiming to manipulate the backend database. These requests often contain unusual query strings with characters like single quotes, double quotes, semicolons, and SQL keywords such as `SELECT`, `INSERT`, `UPDATE`, `DELETE`, and `UNION`. Additionally, the logs may show multiple anomalies indicating SQL errors or unexpected database responses. This behavior is consistent with SQL injection attacks, which aim to exploit vulnerabilities in web application inputs to execute unauthorized SQL commands.