VAPT LLMjacking - SQL Injection Payload Generation via Ollama /api/generate

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•5

Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.