Name: SQL
Creator: Changsha Langhui Information Technology Co., Ltd.
Keywords: SQL,,WAF,XML,PCAP,ATT&CK T1190,,

Dataset Overview

Definition：SQL Injection Detection Rule Datasetis provided byChangsha Langhui Information Technology Co., Ltd.High-quality web safety testing datasets built by security labs. Each piece of data is defined as "XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground Truth"The five-tier association structure, covering joint query injections, error injections, Boolean blinding, time blinding, stacking queries, second injections, wide byte injections of seven major subtypes, ATT&CK framework T1190 (using public-oriented applications) and T1059 (command and script interpreter) mapping, specially designed for WAF/IDS testing rules training and SQLAI training designs.

Dataset Name	SQL Injection Detection Rule Dataset
Total Data Volume	1,000-30,000 Records
Data Type	Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer
Data Source	Langhui Security Lab + Vulnerability Platform Validation Data
License Type	Commercial Licensing Complete authorization documents are attached
Delivery Cycle	2-4 Weeks
SQL injection subtype	Joint-based, Error-based, Boolean-basked Blind, Time-based Blind, Stacked Queries, Second-order, Wide-by-by-te
ATT&CK Mapping	T1190（Exploit Public-Facing Application）、T1059（Command and Scripting Interpreter）
Output Format	JSONL / CSV / Excel / PCAP
Language	Chinese-English Bilingual

Core Data Fields

Each data contains six categories of rule identification, XML detection rules, attack payload, HTTP restore text, PCAP traffic, and standard answers, covering the complete closed loop from rule definition to validation evaluation.

Field Category	Field Count	Typical Fields
Rule Identifier	4	rule_id (only ID of the rules), rule_name (name of the rules), category (sQL injection subtype), severity (serious level: CC/High/Medium)
XML Detection Rules	3	rule_xml (ModSecurity/CRS XML rule), rule_signature (rule signature/regular mode), rule_description (rules note)
Attack Payload	3	Payload (attack on Payload), Payload_type (load type), encoding_type (coding method: URL code/Hex/Base64)
HTTP Reconstructed Text	3	http_request (full text of HTTP request, including Headers+Body), http_response (full text of HTTP response), content_ type (response to Content-Type)
PCAP Traffic	4	pcap_file (PCAP file name), pcap_md5 (file MD5), pcap_size (file size), flow_signature (traffic feature signature)
Ground Truth	4	is_attack (previous attack: True/false), attack_type (type of attack), database_type (type of target database), True_positive_rate (detection accuracy)

Data Sample Showcase

The following is a sample structured JSON after de-identification, showing the typical format of SQL injection quintuple detection data.

{
  "entry_id": "SQLI-2024-001278",
  "rule_id": "SQLI-UNION-0042",
  "rule_name": "Union-based SQL Injection Detection",
  "category": "Union-based SQL Injection",
  "severity": "Critical",
  "rule_xml": "\n  detectSQLi\n  block\n  union\\s+(?:all\\s+)?select\\s+(?:\\d+|null|@@version)\\s*,\\s*(?:\\d+|null|@@version)\n  ARGS|REQUEST_BODY\n",
  "payload": "1' UNION SELECT NULL,username,password,NULL FROM users WHERE '1'='1",
  "payload_type": "Union-based - Credential Extraction",
  "encoding_type": "None (plaintext injection)",
  "http_request": "GET /products.php?id=1'%20UNION%20SELECT%20NULL,username,password,NULL%20FROM%20users%20WHERE%20'1'='1 HTTP/1.1\r\nHost: vulnerable-app.com\r\nUser-Agent: Mozilla/5.0\r\nAccept: text/html\r\nConnection: keep-alive\r\n\r\n",
  "http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 452\r\n\r\n...admin$2a$10$XKoF5Gj...hash......",
  "content_type": "text/html",
  "pcap_info": {
    "pcap_file": "sqli_union_credential_extraction_20240315.pcap",
    "pcap_md5": "d4f819c7a02b3e6f50192834b765ca41",
    "pcap_size": "12834",
    "flow_signature": "HTTP GET with UNION SELECT in query string, response contains database rows in HTML table structure"
  },
  "technique_id": "T1190",
  "cve_ref": "N/A (Application-level vulnerability)",
  "answer": {
    "is_attack": true,
    "attack_type": "Union-based SQL Injection",
    "database_type": "MySQL 8.0",
    "true_positive_rate": 0.96
  }
}

AI Application Scenarios

Intelligent WAF Rule Generation

30,000 XML detection rules + Payload matching data, training AI models to automatically extract features from attack flows and generate testing rules in WAF/ModSecure/CRS format, significantly reducing the rule development cycle.

Training in SQLi testing model

The five-metaset data provide complete training materials for the in-depth learning model and support the SQL injection testing model training for the CNN/RN/Transformer structure, covering the whole subtype of joint queries, blinding, and reporting errors.

Code Audit AI Auxiliary

Based on the Payload attack and the standard answer map, the training code audit of SQL penetration points in the AIA AIS source code, locate unparametric database query statements and generate recommendations for restoration.

Automation of Safe Operation (SOAR)

PCAP traffic data + HTTP returned text + associated data for standard answers, training SOAR script automated implementation: real-time flow analysis ⁇ SQL injection test rules match automatic blocking response.

Infiltration testing AI training

The rich Payload variable and injection data are used to train the Oscillation Test AI agents to develop the capability to automate SQL-inventing and exploit loopholes and to improve the efficiency of security assessments.

Database security base model

SQL injection data covering multiple databases such as MySQL/PostgreSQL/MSSQL/Oracle, training database security base model, building common SQL injection detection and defense AI capabilities.

Frequently asked questions

How are datasets authorized? Can it be used for business AI training?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Provide business authorization to explicitly cover business AI training and safety product development.

Are the data sets of the Payload source reliable?

Payload is a model of security tests from the Longway Safety Laboratory, the open gap platform (HackerOne/Bugcrowd, etc.) to verify data, and the operational variations of the OWASP Top 10 standard test. All data are marked by security analysts to ensure authenticity and effectiveness.

Which WAF/IDS platforms are the XML test rules compatible?

The rules are expressed in XML format in ModSecurity CRS (Corre Rule Set) and can be used directly for open source WAFs such as ModSecure/AWSCoraza. The regular signature of the rules is also indicated, facilitating transplantation to commercial WAF platforms such as Cloudflare, F5 BIG-IP ASM.

What are the scenarios for PCAP traffic data?

The PCAP document contains a complete three-time CTTP request/response to the TCP disconnection process, covering a variety of real scenarios such as the GET/POST request, different Content-Type (form-urlencoded/multipart/JSON), different injection points (URL parameters/Cookie/Header/Body).

How do you obtain data or business advice?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Our DataAssets API platform supports both standard datasets and on-demand customization. Please contact us for a detailed data catalog, sample preview, and quote plan.

A customized SQL-injected detection program?

Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant web security data assets for AI companies and research institutions. Supports flexible combinations by SQL injection subtype, by database platform, and by detection rule format.

Data sample preview Customisation of SQL injection programme Professional technical support

Data Sample Preview Customized Discipline-Specific Solutions Professional Technical Support