Abstract:Due to well-hidden and stage-triggered properties of second-order SQL injections in web applications, current approaches are ineffective in addressing them and still report high false negatives and false positives. To reduce false results, we propose a Proxy-based static analysis and dynamic execution mechanism towards detecting, locating and preventing second-order SQL injections (SQLPsdem). The static analysis first locates SQL statements in web applications and identifies all data sources and injection points (e.g., Post, Sessions, Database, File names) that injection attacks can exploit. After that, we reconstruct the SQL statements and use attack engines to jointly generate attacks to cover all the state-of-the-art attack patterns so as to exploit these applications. We then use proxy-based dynamic execution to capture the data transmitted between web applications and their databases. The data are the reconstructed SQL statements with variable values from the attack payloads. If a web application is vulnerable, the data will contain malicious attacks on the database. We match the data with rules formulated by attack patterns to detect first and second-order SQL injection vulnerabilities in web applications, particularly the second-order ones. We use a representative and complete coverage of attack patterns and precise matching rules to reduce false results. By escaping and truncating malicious payloads in the data transmitted from the web application to the database, we can eliminate the possible negative impact of the data on the database. In the evaluation, by generating 52,771 SQL injection attacks using four attack generators, SQLPsdem successfully detects 26 second-order (including 13 newly discovered ones) and 375 first-order SQL injection vulnerabilities in 12 open-source web applications. SQLPsdem can also 100% eliminate the malicious impact of the data with negligible overhead.

SQL Injection Vulnerability Detection Based on Webpage DOM Tree Comparison

Test Method on Code Injection Vulnerabilities of Web Application

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

The Detection and Defense Mechanism for SQL Injection Attack Based on Web Application

Design and Implementation of SQL Injection Vulnerability Scanning Tool

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system

Web Information Segmentation Method Based on DOM Structure Tree

Exploring Defense of SQL Injection Attack in Penetration Testing

Method of defense SQL injection attacks based on sequence alignment

A Detective Tool Against Sql Injection Attacks Based on Static Analysis and Dynamic Monitor

Test Sql Injection Vulnerabilities In Web Applications Based On Structure Matching

Design and implementation of a web application vulnerability detection system

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Detection of structure query language injection vulnerability in web driven database application

Web Vulnerability Scanning Software

SQL Injection Attack Detection and Prevention Techniques Using Deep Learning

High-Interaction Honeypot System for SQL Injection Analysis

Trident: Detecting SQL Injection Attacks via Abstract Syntax Tree-based Neural Network

Method of Preventing SQL Injection Attack Using PHP

SQLPsdem: A Proxy-Based Mechanism Towards Detecting, Locating and Preventing Second-Order SQL Injections