## Detecting Web Attacks via Logs

### SQL Injection (SQLi)
Look for SQL syntax in the URL/URI.
*   `UNION SELECT`
*   `OR 1=1`
*   `%27` (Single Quote encoded).

### Cross Site Scripting (XSS)
Look for HTML/JS tags.
*   `<script>`
*   `alert(1)`
*   `%3Cscript%3E`

### Directory Traversal
Trying to escape the web root.
*   `../../../../etc/passwd`
*   `..%2F..%2F` (Encoded).