Web application database protection from SQLIA using permutation encoding

Day after day, SQL Injection (SQLI) attack is consistently proliferating across the globe. According to Open Web Application Security Project (OWASP) Top Ten Cheat Sheet-2014, SQLI is at top in the list of online attacks. The cause of spread of SQLI is thought to be Unsecure Software Engineering. The Software Development process itself appears to look at security as an add-on to be checked and deployed towards the end of the software development lifecycle which leads to vulnerabilities in web applications. This paper is an attempt to integrate security in early stages of SDLC i.e. in design phase to mitigate SQLI vulnerability. How SQLI attack happens is illustrated. Threat Modeling is performed to mitigate the SQLI vulnerability.

The powerful Open Web Application Security Project (OWASP)-Zed Attack Proxy (ZAP) tool secures web applications with extensive security testing. Its main goal is to find and fix web application vulnerabilities before they can be exploited. The goal is to improve web application security using OWASP ZAP scans and inspections. Simulating SQL injection and cross-site scripting attacks using the tool reveals an application's security flaws. OWASP ZAP automates testing to protect sensitive data and web application integrity. The purpose is to protect online applications from attacks to reduce security breaches and ensure industry compliance. Modern online applications' security and dependability depend on OWASP ZAP's systematic vulnerability discovery and mitigation. By enhancing scan performance and providing actionable security information, the experimental results show that the OWASP ZAP helps safeguard online applications and reduce the danger of cyberattacks. The objective is to enhance its skills to provide comprehensive, prompt, dependable security evaluations across various situations.

In SQLIA, attacker injects an input in the query in order to change the structure of the query intended by the programmer and therefore, gain access to the data in the underlying database. Due to the significance of the stored data, web application's security against SQLIA is vital. In this paper we propose a tool that is capable of reporting the transformations needed to reinforce the security of a Java-based web application and its database against SQLIAs. This tool which is based on static analysis and runtime validation uses our new technique for detection and prevention of SQLIAs. In our technique user inputs in SQL queries are removed and some information is gathered in order to make the detection easier and faster at runtime. According to these information the tool reports the transformations needed and the location of the transformations in source code and therefore after applying the transformations the result would be a reinforced web application against SQLIAs.

Over the years, injection vulnerabilities have been at the top of the Open Web Application Security Project Top 10 and are one of the most damaging and widely exploited types of vulnerabilities against web applications. Structured Query Language (SQL) injection attack detection remains a challenging problem due to the heterogeneity of attack loads, the diversity of attack methods, and the variety of attack patterns. It has been demonstrated that no single model can guarantee adequate security to protect web applications, and it is crucial to develop an efficient and accurate model for SQL injection attack detection. In this paper, we propose synBERT, a semantic learning-based detection model that explicitly embeds the sentence-level semantic information from SQL statements into an embedding vector. The model learns representations that can be mapped to SQL syntax tree structures, as evidenced by visualization work. We gathered a wide range of datasets to assess the classification performance of the synBERT, and the results show that our approach outperforms previously proposed models. Even on brand-new, untrained models, accuracy can reach 90% or higher, indicating that the model has good generalization performance.

Today almost all organizations have changed their traditional systems and have improved their performance using web-based applications. This process will make more profit and at the same time will increase the efficiency of their activities through customer support services and data transactions. Usually, web application take inputs from users through web form and send this input to get the response from database. Modern web-based application use web database to store all critical information such as user credentials, financial and payment information, company statistics etc. However error in validation of user input can cause database vulnerable to Structured Query Language Injection (SQLI) attack. By using SQLI attack, the attackers might insert malicious code in the user input and trying to gain access to the confidential and sensitive data from database. Security tester need to identify the appropriate test cases before starting exploiting SQL vulnerability in web-based application during testing phase. Identifying the test cases of a web application and analyzing the test results of an attack are important parts and consider as critical issues that affects the effectiveness of security testing. Thus, this research focused on the developing a framework for testing and detecting SQL injection vulnerability in web application. In this research, test cases will be generated automatically based on SQLI attack pattern and then the results will be executed automatically based on generated test cases. The primary focus in this paper is to develop a framework to automate security testing based on input injection attack pattern. To test our framework, we install a vulnerable web application and test result shows that the proposed framework can detect SQLI vulnerability successfully.

SQL injection (SQLi) attacks are one of the oldest and most serious security threats, consistently ranking among the top ten critical web security risks. Traditional defense mechanisms against SQL injection predominantly use blacklists to disallow common injection characters or terms. However, the major challenge for these systems is to create a comprehensive list of potential SQLi characters, terms, and multi-terms that encompass various types of SQLi attacks (time-based, error-based, etc.), taking into account various SQL datasets (such as MySQL, Oracle, and NoSQL). Recently, some research studies have concentrated on feature learning from SQL queries by applying some well-known deep architectures to detect SQLi attacks. Motivated by a similar objective, this research introduces a novel deep learning-based SQLi detection system named “Bidirectional LSTM-CNN based on Multi-View Consensus” (MVC-BiCNN). The proposed method implements a pre-processing step that generates multiple views from SQL data by semantically encoding SQL statements into their corresponding SQL tags. By utilizing two different main layers, which are bidirectional long short-term memory (LSTM) and convolutional neural network (CNN), the proposed method learns a joint latent space from multi-view representations. In the detection phase, the proposed method yields separate predictions for each representation and assesses whether the query constitutes an SQLi attack based on a consensus function’s output. Moreover, Interpretable Model-Agnostic Annotations (LIME), one of the methods of Explainable Artificial Intelligence (XAI), is employed for the purpose of interpreting the model’s results and analyzing the SQL injection (SQLi) inputs. The experimental results demonstrate that MVC-BiCNN outperforms the baseline methods, yielding 99.96% detection rate.

Web application development is error prone and results in applications that are vulnerable to attacks by malicious users. The global accessibility of Web applications makes this an extremely serious problem. According to the Open Web Application Security Project (OWASP)’s top ten list that identifies the most serious web application vulnerabilities, the top three vulnerabilities in 2007 [84] were: (1) Cross Site Scripting (XSS) and (2) Injection Flaws (such as SQL Injection). Even after it has been widely reported that web applications suffer from these vulnerabilities, XSS and SQL Injection vulnerabilities remained among the top three vulnerabilities listed in OWASP’s top ten list in 2010 [85] and 2013 [86].

Based on OWASP, code injection is one of the top lists of security risks. Structured Query Language (SQL) Injection is one of these types of attacks. SQL injection attack is an attack by spoofing the server to execute malicious code. The main object of this paper is to identify relevant works about deep learning methods to detect SQL-Injection on web applications. To achieve that, we conduct a survey review of the literature. In this study, we provide a review of 14 studies using deep learning algorithms to detect SQL Injection on web applications and it provides a comparison between them. Deep learning has great potential in threat intelligence detection.

SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database-driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV). This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object-oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.

Web Application Development has shown progressive and rapid growth using various techniques. Nonetheless, web application security is a major component in web development that is often overlooked or not properly focused on. Due to ad hoc existence and poor code written, most available web applications are vulnerable and desirable target for the attackers. To alleviate this issue, the use of defensive programming basic technique allows the developers to develop secure applications. Defensive programming includes validate output and correctly manages error messages. This avoids the misuse of snippets and builds the program in a consistent way despite unpredictable inputs. The purpose of this paper is twofold. Firstly, this paper discussed the development of a web application program using PHP as server-side scripting exploiting defensive programming techniques to overwhelm web application vulnerabilities. Secondly, this paper examined common vulnerabilities of web application risks refer to Open Web Application Security Project to validate the effectiveness of defensive programming technique. The work presented in this paper shall be a fundamental guideline for the development of secure web-based applications.

All projects conducted in both the OWASP (Open Web Application Security Project) and the WASC (Web Application Security Consortium) are open-projects in which a company and an individual have voluntarily participated with a vision for web application security. Specifically, these open type projects have studied the web application vulnerabilities and thus have provided their results. Therefore, all these projects can be considered as very influential open-projects. This paper will examine overall introduction of the OWASP and the WASC and then, the major features of their different projects which have been currently conducting as analyzing the similarities and differences between the OWASP and the WASC. Based on the results, the study may suggest a type of synergetic effects from their cooperative work. Finally, with related to the web application security area, this research will discuss about the latest trends in industrial as well academic fields and further directions toward its development.KeywordsWeb service vulnerabilityOWASPWASC

Various information can be found on the internet by accessing the website. Information on the internet should be guaranteed integrity and service / layananya from the source to the user. In website development, technology profile, access speed, and security is a factor that must be taken to ensure that the information and services contained therein can be useful for the user. Internet network is public and global, at the time of service of data sent from one computer to another on the Internet, the data will pass through a number of computers. Denial-of-Service Attack is one of the attacks on web security system which can inhibit the activity of the working of a service or turn it off, so the user has the right / interest can not use these services as expected. Services web application has vulnerability to an attack. One way to detect security flaws in web applications is to use a search application security loopholes. OWASP (Open Web Application Security Project) capable of searching for security loopholes website. There are some striking technique, among others: Cross Site Scripting, Injection, Malicious File Execution, Insecure Direct Object Reference and others. Results from this study is the method of coping and prevention techniques of Denial Of Service Attack, and improved service website. Keywords: Technology profile, OWASP, Denial Of Service Attack.

The adoption of digital technologies in healthcare is growing rapidly, and with it, the associated cybersecurity risks are also increasing. In particular, web applications, which can be used to manage and share sensitive health and personal information, require strong security measures to prevent data breaches and ensure compliance with regulatory standards. This paper investigates the applicability of the Open Web Application Security Project (OWASP) guidelines in the healthcare domain. Through a literature review, we identified the most common security requirements considered and used in Digital Health (DH) technologies and assessed their alignment with OWASP Application Security Verification Standard (ASVS). Furthermore, a questionnaire, involving Italian healthcare facilities and Information Technology (IT) companies operating in the healthcare sector, highlighted a significant gap between the availability of security standards and guidelines, and their actual knowledge and use in practice. Based on these findings, we propose a context-aware tool that guides developers and testers in applying OWASP standards throughout the software development lifecycle. The proposed tool aims to provide tailored security recommendations, structured checklists, and test planning based on application context, offering a practical bridge between frameworks and real-world adoption in clinical environments.

-- OWASP (Open Web Application Security Project) version 4 issued by a non-profit organization called owasp.org which is dedicated to the security of web-based applications. This systematic review is intended to review whether the Open Web Application Security Project (OWASP) method is widely used to detect security in a website-based Information System. In this systematic review, we review 3 literature from several publisher sources and make a comparison regarding OWASP version 4 results and the security level of a web server from the publisher's source.Keywords— OWASP, Website Vulnerability, Website Security Detection

Web applications are becoming an important part of our daily life. So attacks against them also increases rapidly. Of these attacks, a major role is held by SQL injection attacks (SQLIA). This paper proposes a new method for preventing SQL injection attacks in JSP web applications. The basic idea is to check before execution, the intended structure of the SQL query. For this we use semantic comparison. Our focus is on stored procedure attack in which query will be formed within the database itself and so difficult to extract that query structure for validation. Also this attack is less considered in the literature.