sql injection
86673708
An algorithm for detecting SQL injection vulnerability using black box testing
SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV) This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.
J. Ambient Intell. Humaniz. Comput.
Muhammad Saidu Aliero Imran Ghani Kashif Naseer Qureshi Mohd Foad Rohani
199681542
DIAVA: A Traffic Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data
SQL injection attack (SQLIA) is among the most common security threats to web based services that are deployed on cloud. By exploiting web software vulnerabilities, SQL injection attackers can run arbitrary malicious code on target databases to acquire or compromise sensitive data. Although web application firewalls (WAFs) are offered by most cloud service providers, tenants are reluctant to pay for them, since there are few approaches that can report accurate SQLIA statistics for their deployed services. Traditional WAFs focus on blocking suspicious SQL requests. Few of them can accurately decide whether an attack is really harmful and quickly answer how severe the attack is. To raise the tenants' awareness of the seriousness of SQLIAs, in this paper, we introduce a novel traffic based SQLIA detection and vulnerability analysis framework named DIAVA, which can proactively send warnings to tenants promptly. By analyzing the bidirectional network traffic of SQL operations and applying our proposed multilevel regular expression model, DIAVA can accurately identify successful SQLIAs among all the suspects. Meanwhile, the severity of such SQLIAs and the vulnerabilities of the corresponding leaked data can be quickly evaluated by DIAVA based on its GPU based dictionary attack analysis engine. Experimental results show that DIAVA not only outperforms state of the art WAFs in detecting SQLAs from the perspectives of precision and recall, but also enables real time vulnerability evaluation of leaked data caused by SQL injection.
IEEE Transactions on Reliability
Haifeng Gu Jianning Zhang Tian Liu Ming Hu Junlong Zhou Tongquan Wei Mingsong Chen
211830333
Detection of SQL injection based on artificial neural network
Abstract The SQL injection, a common web attack, has been a challenging network security issue which causes annually millions of dollars of financial loss worldwide as well as a large amount of users' privacy data leakage. This work presents a high accuracy SQL injection detection method based on neural network. We first acquire authentic user URL access log data from the Internet Service Provider(ISP) ensuring that our approach is real, effective and practical. We then conduct statistical research on normal data and SQL injection data. Based on the statistical results, we design eight types of features and train an MLP model. The accuracy of the model maintains over 99% Meanwhile, we compare and evaluate the training effect of other machine learning algorithms(LSTM, for example) the results reveal that the accuracy of our method is superior to the relevant machine learning algorithms.
Knowl. Based Syst.
Peng Tang Weidong Qiu Zheng Huang Huijuan Lian Guozhen Liu
232268804
SQL Injection Attack Detection and Prevention Techniques Using Machine Learning
Web application attacks are incessantly increasing in number and in severity. The big data available on the internet motivates hackers to launch new kind of attacks. In this context, intensive research on web application security have been conducted. The most dangerous attack that target web applications is the Structured Query Language Injection (SQLI) This attack represents a serious threat to the web applications. Several research works have been conducted to mitigate this attack either by preventing it from an early stage or detecting it when it occurs. In this paper, we present an overview of the SQL injection attack and a classification of the newly proposed detection and prevention solutions. We classify the different attack sources, goals, and types. Moreover, we discuss and classify the most important and recent proposed solutions to mitigate this attack especially those based on ontology and machine learning.
Ines Jemal Omar Cheikhrouhou Habib Hamam Adel Mahfoudhi
212648342
A Detection and Prevention Technique on SQL Injection Attacks
With the web advancements are rapidly developing, the greater part of individuals makes their transactions on web, for example, searching through data, banking, shopping, managing, overseeing and controlling dam and business exchanges, etc. Web applications have gotten fit to numerous individuals' day by day lives activities. Dangers pertinent to web applications have expanded to huge development. Presently a day, the more the quantity of vulnerabilities will be diminished, the more the quantity of threats become to increment. Structured Query Language Injection Attack (SQLIA) is one of the incredible dangers of web applications threats. Lack of input validation vulnerabilities where cause to SQL injection attack on web. SQLIA is a malicious activity that takes negated SQL statement to misuse data driven applications. This vulnerability admits an attacker to comply crafted input to disclosure with the application's interaction with back end databases. Therefore, the attacker can gain access to the database by inserting, modifying or deleting critical information without legitimate approval. The paper presents an approach which detects a query token with reserved words based lexicon to detect SQLIA. The approach consists of two highlights: the first one creates lexicon and the second step tokenizes the input query statement and each string token was detected to predefined words lexicon to prevent SQLIA. In this paper, detection and prevention technologies of SQL injection attacks are experimented and the result are satisfactory.
2020 IEEE Conference on Computer Applications(ICCA)
Zar Chi Su Su Hlaing Myo Khaing
221162364
A novel technique to prevent SQL injection and cross site scripting attacks using Knuth Morris Pratt string match algorithm
Structured Query Language (SQL) injection and cross site scripting remain a major threat to data driven web applications. Instances where hackers obtain unrestricted access to back end database of web applications so as to steal, edit, and destroy confidential data are increasing. Therefore, measures must be put in place to curtail the growing threats of SQL injection and XSS attacks. This study presents a technique for detecting and preventing these threats using Knuth Morris Pratt (KMP) string matching algorithm. The algorithm was used to match user's input string with the stored pattern of the injection string in order to detect any malicious code. The implementation was carried out using PHP scripting language and Apache XAMPP Server. The security level of the technique was measured using different test cases of SQL injection, cross site scripting (XSS) and encoded injection attacks. Results obtained revealed that the proposed technique was able to successfully detect and prevent the attacks, log the attack entry in the database, block the system using its mac address, and also generate a warning message. Therefore, the proposed technique proved to be more effective in detecting and preventing SQL injection and XSS attacks
EURASIP J. Inf. Secur.
Oluwakemi Christiana Abikoye Abdullah Sinan Colakoglu Hawrin S Abubakar Ahmad Dokoro Haruna Noah Oluwatobi Akande Anthonia Aderonke Kayode
208093048
SQLIADP: A Novel Framework to Detect and Prevent SQL Injection Attacks
Nowadays, Web Based systems face a lot of threats. Web Based systems completely rely on databases. SQL injection attacks are the most common and complex threat to the databases of Web Based systems. Several approaches that protect web applications from SQL Injection attacks are available. Most of the techniques apply defense mechanics that perform on the SQL Injection attacks; much of them produce huge false positives and maximum response time. In this paper, we are proposing a novel framework, SQL Injection Attack Detection and Prevention (SQLIADP) combination of Java, web technologies, and Special Text Strings to protect the Web Based systems against the SQL Injection attacks with zero false reduction and minimal response time. The implemented framework is very efficient and works effectively against SQL Injection.
Smart Intelligent Computing and Applications
Rajesh Vemulakonda K Venkatesh
212842491
Intrusion Detection Systems for Mitigating SQL Injection Attacks: Review and State of Practice
Databases are widely used by organizations to store business critical information, which makes them one of the most attractive targets for security attacks. SQL Injection is the most common attack to webpages with dynamic content. To mitigate it, organizations use Intrusion Detection Systems (IDS) as part of the security infrastructure, to detect this type of attack. However, the authors observe a gap between the comprehensive state of the art in detecting SQL Injection attacks and the state of practice regarding existing tools capable of detecting such attacks. The majority of IDS implementations provide little or no protection against SQL Injection attacks, with exceptions like the tools Bro and ModSecurity. In this article, the authors compare these tools using the CSIC dataset in order to examine the state of practice in database protection from SQL Injection attacks, identifying the main characteristics and implementation details needed for IDSs to successfully detect such attacks. The experiments indicate that signature based IDS provide the greatest coverage against SQL Injection.
Int. J. Inf. Secur. Priv.
Rui Silva Raul Barbosa Jorge Bernardino
226066959
Analisis dan Perbandingan Pencegahan SQL Injection pada Framework CodeIgniter dengan Escaping Query dan Framework Laravel dengan Eloquent ORM
Abstrak SQL Injection adalah suatu serangan yang dilakukan dengan cara menyisipkan suatu perintah query SQL ke dalam bagian input agar dapat mengakses database yang terdapat pada aplikasi web. SQL Injection sering terjadi karena tidak adanya filtering yang dilakukan pada saat data input masuk ke dalam database. Oleh karena itu, diperlukan sebuah pencegahan agar input yang masuk dapat diseleksi terlebih dahulu sebelum masuk ke dalam database. Pencegahan tersebut dapat diperoleh dari fungsi yang terdapat pada bahasa pemrograman serta framework dari bahasa pemrograman tersebut. Pada penelitian ini, dilakukan analisis dan perbandingan akurasi pencegahan serangan SQL injection pada framework CodeIgniter dan framework Laravel. Pada framework CodeIgniter digunakan fungsi escaping query untuk mencegah serangan SQL injection. Sedangkan, pada framework Laravel digunakan fungsi eloquent ORM untuk mencegah serangan SQL injection. Berdasarkan hasil pengujian dan analisa diperoleh bahwa serangan SQL injection pada framework CodeIgniter dan framework Laravel dapat dicegah dengan sama baik menggunakan fungsi escaping query pada framework CodeIgniter dan fungsi eloquent ORM pada framework Laravel. Dari hasil pengujian diperoleh akurasi 100% dari 293 serangan SQL injection. Kata kunci SQL, SQL Injection, CodeIgniter, Laravel, Akurasi Abstract SQL Injection is an attack carried out by inserting a SQL query command into the input section in order to access the database contained in the web application. SQL Injection often occurs because there is no filtering done when input data enters the database. Therefore, we need a precaution so that incoming input can be selected before entering the database. Prevention can be obtained from the functions contained in the programming language and the framework of the programming language. In this study, an analysis and comparison of the accuracy of preventing SQL injection attacks on the CodeIgniter and Laravel frameworks was carried out. In the CodeIgniter framework the escaping query function is used to prevent SQL injection attacks. Meanwhile, the Laravel framework uses the ORM eloquent function to prevent SQL injection attacks. Based on the results of testing and analysis, it was found that SQL injection attacks on the CodeIgniter framework and the Laravel framework can be prevented equally by using the escaping query function on the CodeIgniter framework and the ORM eloquent function on the Laravel framework. From the test results obtained 100% accuracy of 293 SQL injection attacks. Keywords: SQL, SQL Injection, CodeIgniter, Laravel, Accuracy
Aedhelio Pratama Parman Sukarno Aulia Arif Wardana
218870218
DeepSQLi: deep semantic learning for testing SQL injection
Security is unarguably the most serious concern for Web applications, to which SQL injection (SQLi) attack is one of the most devastating attacks. Automatically testing SQLi vulnerabilities is of ultimate importance, yet is unfortunately far from trivial to implement. This is because the existence of a huge, or potentially infinite, number of variants and semantic possibilities of SQL leading to SQLi attacks on various Web applications. In this paper, we propose a deep natural language processing based tool, dubbed DeepSQLi, to generate test cases for detecting SQLi vulnerabilities. Through adopting deep learning based neural language model and sequence of words prediction, DeepSQLi is equipped with the ability to learn the semantic knowledge embedded in SQLi attacks, allowing it to translate user inputs (or a test case) into a new test case, which is se mantically related and potentially more sophisticated. Experiments are conducted to compare DeepSQLi with SQLmap, a state of the art SQLi testing automation tool, on six real world Web applications that are of different scales, characteristics and domains. Empirical results demonstrate the effectiveness and the remarkable superiority of DeepSQLi over SQLmap, such that more SQLi vulnerabilities can be identified by using a less number of test cases, whilst running much faster.
ISSTA
Muyang Liu Ke Li Tao-An Chen