Hidden web crawling for SQL injection detection

A Tool Design for SQL injection vulnerability detection based on improved crawler

SummaryThis work presents an extended and enhanced gray‐box combinatorial security testing methodology for SQL injection vulnerabilities in web applications. We propose multiple new attack grammars modelling SQLi attacks against MySQL‐compatible databases, each one targeting a different injection context. Additionally, these grammars are also dynamically refined at the beginning of each attack against an endpoint of a web application, as a further optimization of the used attack model by taking into account the specifics of the generated query of that endpoint. Our goal is to enhance existing combinatorial approaches for detecting SQL injection vulnerabilities. The newly developed methodology is implemented in a prototype security testing tool called SQLInjector+, which is an extension of an earlier prototype developed by us in prior work. This improved tool can attack (i.e. test) any web application that uses a MySQL‐compatible database management system. We evaluate our revised approach and improved prototype tool in a case study comprising of different kinds of web applications to which SQLi is a potential security threat. The case study contains the well‐known verification framework WAVSEP among other five real‐world web applications and one web application firewall. Our generated attack vectors, constructed via combinatorial methods applied to our improved and dynamically optimized attack grammars, are capable of injecting every known vulnerable endpoint in WAVSEP and also of finding new vulnerable parameters in some of the real‐world applications investigated in this paper. Our approach performs equally well or better when compared with existing state‐of‐art of SQL injection security testing tools (sqlmap, w3af, wapiti and fuzzdb) across all tested web applications in the case study.

SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database-driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV). This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object-oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.

Web applications have become an integral part of the daily lives of millions of users. Unfortunately, web applications are also frequently targeted by attackers, and critical vulnerabilities such as cross-site scripting and SQL injection are still common. As a consequence, much effort in the past decade has been spent on mitigating web application vulnerabilities. Current techniques focus mainly on sanitization: either on automated sanitization, the detection of missing sanitizers, the correctness of sanitizers, or the correct placement of sanitizers. However, these techniques are either not able to prevent new forms of input validation vulnerabilities such as HTTP Parameter Pollution, come with large runtime overhead, lack precision, or require significant modifications to the client and/or server infrastructure. In this paper, we present IPAAS, a novel technique for preventing the exploitation of cross-site scripting and SQL injection vulnerabilities based on automated data type detection of input parameters. IPAAS automatically and transparently augments otherwise insecure web application development environments with input validators that result in significant and tangible security improvements for real systems. We implemented IPAAS for PHP and evaluated it on five real-world web applications with known cross-site scripting and SQL injection vulnerabilities. Our evaluation demonstrates that IPAAS would have prevented 83% of SQL injection vulnerabilities and 65% of cross-site scripting vulnerabilities while incurring no developer burden.

Web applications are an integral part of today's digital landscape, serving various functions from e-commerce to social networking. However, they are also prime targets for cyber-attacks, with SQL-Injection vulnerabilities posing a significant threat to their security. This project addresses the critical issue of SQL-Injection vulnerabilities in web applications by offering a comprehensive analysis, leveraging Python and classical machine learning algorithms such as Naïve Bayes. The research method employed in this project involves procuring real-world datasets, conducting data pre-processing, and using decision tree classifiers. These steps collectively provide an automated and scalable solution for identifying, understanding, and mitigating SQL-Injection riskslearning methods like Deep Neural Networks (DNN). A comprehensive comparative analysis of these algorithms has been carried out, assessing their performance based on accuracy metrics.

Web applications are becoming an essential part of our everyday lives. Many\nof our activities are dependent on the functionality and security of these\napplications. As the scale of these applications grows, injection\nvulnerabilities such as SQL injection are major security challenges for\ndevelopers today. This paper presents the technique of automatic query\nsanitization to automatically remove SQL injection vulnerabilities in code. In\nour technique, a combination of static analysis and program transformation are\nused to automatically instrument web applications with sanitization code. We\nhave implemented this technique in a tool named ASSIST (Automatic and Static\nSQL Injection Sanitization Tool) for protecting Java-based web applications.\nOur experimental evaluation showed that our technique is effective against SQL\ninjection vulnerabilities and has a low overhead.\n

With1 the rapid development of computer network technology, people's life and work have become more and more dependent on the Internet. Consequent network security issues have also received much attention. At present, SQL injection attacks have become the main method of hacking. SQL injection vulnerabilities seriously threaten the security of WEB application systems. This article takes the PHP language as an example, introduces the reasons for the SQL injection in detail, conducts in-depth research on the common SQL injection attack methods. Based on the practical penetration testing practice, puts forward the SQL injection detection technology and how to avoid SQL injection vulnerability when writing WEB program code. This article provides detailed technical support for testing SQL injection and provides a powerful guarantee for WEB information system in SQL injection defense.

As Internet is increasingly prosperous, Web services become more common in our social life. As users can access pages on the Web directly, Web application plays a vital role in various domains such as e-finance and public-services. Inevitably, it will be followed by unprecedented amount of attacks and exploitations. Amongst all of those attacks, SQL injection attacks have consistently high rank in last years due to corresponding vulnerabilities. It is crucial to checking this vulnerabilities before web services being public. In our paper we present an effective approach for testing, MOSA, and mutation operators set to its underpinning. Using this approach we can produce test inputs that cause executable and malignant SQL statement efficiently. Besides that, we do numerous experiments and the results demonstrate that the mutation approach can detect SQL injection vulnerabilities and generate inputs that bypass web application firewalls.

Dependence on web applications is increasing very rapidly in recent time for social communications, health problem, financial transaction and many other purposes. Unfortunately, the presence of security weaknesses in web applications allows malicious user's to exploit various security vulnerabilities and become the reason of their failure. Currently, SQL Injection (SQLI) attacks exploit most dangerous security vulnerabilities in various popular web applications i.e. eBay, Google, Facebook, Twitter etc. Research on taint based vulnerability detection has been quite intensive in the past decade. However, these techniques are not free from false positive and false negative results. In this paper, we propose an approach to minimize false positive in SQLI vulnerability detection techniques using data mining concepts. We have implemented a prototype tool for PHP, MySQL technologies and evaluated it on six real world applications and NIST Benchmarks. Our evaluation and comparison results show that proposed technique detects SQLI vulnerabilities with low percentage of false positives.

Web applications have been widely adopted to access a myriad of services, regardless of their criticality and context. Applications developers have accelerated their efforts to meet the demands of a competitive and dynamic market for innovative products. Despite considerable efforts to detect and mitigate vulnerabilities in applications, their prevalence continues to increase, primarily due to the rapid pace of software development, which often prioritizes deployment speed, compromising security. This paper presents KAVe, a static analysis tool that leverages a multi-layer knowledge graph and a multi-agent system to detect web application vulnerabilities with high precision. This paper showcases KAVe's implementation and ability to identify SQL injection (SQLi) and cross-site scripting (XSS) vulnerabilities in real-world PHP applications.

On automated prepared statement generation to remove SQL injection vulnerabilities

Web sites are dynamic, static, and most of the time a combination of both. Web sites need protection in their database to assure security. An SQL injection attacks interactive web applications that provide database services. These applications take user inputs and use them to create an SQL query at run time. In an SQL injection attack, an attacker might insert a malicious SQL query as input to perform an unauthorized database operation. Using SQL injection attacks, an attacker can retrieve or modify confidential and sensitive information from the database. It may jeopardize the confidentiality and security of Web sites which totally depends on databases. This report presents a “code reengineering” that implicitly protects the applications which are written in PHP from SQL injection attacks. It uses an original approach that combines static as well as dynamic analysis. [2] In this report, I mentioned an automated technique for moving out SQL injection vulnerabilities from Java code by converting plain text inputs received from users into prepared statements. [3]

With the rise of the web as a dominant application platform, web security vulnerabilities are of increasing concern. Ideally, the web application development process would detect and correct these vulnerabilities before they are released to the public. This research aims to quantify the effectiveness of software developers at security code review as well as determine the variation in effectiveness among web developers. We hired 30 developers to conduct a manual code review of a small web application. The web application supplied to developers had seven known vulnerabilities, including three different types: Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection. Our findings include: (1) none of the subjects found all confirmed vulnerabilities, (2) more experience does not necessarily mean that the reviewer will be more accurate or effective, and (3) reports of false vulnerabilities were significantly correlated with reports of valid vulnerabilities.

As web applications become increasingly popular for offering data and services among businesses and organizations they also become more susceptible to security risks. Many organizations rely today on Web Vulnerability Scanners (WVSs) to identify vulnerabilities in their web applications. However, one of the most prevalent types of web application vulnerabilities, SQL Injections (SQLi), can often go undetected by WVSs. OWASP ZAP is an open-source web vulnerability scanner that allows security professionals to develop rules to improve vulnerability detection capability. In this paper, a new method is proposed to improve the detection capability of OWASP ZAP for SQLi. We aim to accurately detect the four major types of SQLi: Error-based, Union-based, Time-based blind, and Authentication Bypass. We implemented this new method using OWASP ZAP detection policies. The method was tested against two benchmark vulnerable web applications, Mutillidae and WebGoat, and was shown to significantly improve the detection of SQL injection attacks.

According to OWASP top10 Application Security Risks [8, 9] SQL injection (SQLi) remains the most dangerous and most commonly exploited vulnerability in web applications. Thus, a lot of attentions are devoted by the scientific community for the development of SQLi verification tools. In this paper we focus on the development of an efficient, black box, SQLi vulnerability scanner to achieve an accurate detection. Our new approach is based on the use of structural similarity between rejection pages and their corresponding injection pages. A software prototype has been implemented and showed promising results as compared to well-known web application scanners.