Search to detect XSS attacks

JB2021 — Thu, 28 Oct 2021 12:12:09 GMT

Hello,

I have made a search/query to detect the attacks of XSS the problem I have is that it also shows valid requests because there are words (cookie, script) that also appear as invalid requests

¿How could I filter so that it only shows the attacks?

search "<script>" OR "</script>" OR "&#" OR "script" OR "`" OR "cookie" OR "alert" OR "%00"| append [ datamodel Web search | where like(uri,"http:/%") OR like(uri,"*javascript*") OR like(uri,"*vbscript*") OR like(uri,"*applet*") OR like(uri," *script*") OR like(uri,"*frame*")

topic Search to detect XSS attacks in Security

Search to detect XSS attacks