Abstract:SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database-driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV). This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object-oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Test Method on Code Injection Vulnerabilities of Web Application

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Research on the Technology of Detecting SQL Injection Vulnerabilities Based on Data Flow Analysis

Design and implementation of a web application vulnerability detection system

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Source Code Vulnerability Detection Technology Based on Taint Analysis

Software Vulnerability Detection Method Based on the Lexical and Syntax Analysis

Design and Implementation of Code Security Inspection System Based on SVN

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

SQL Injection Vulnerability Detection Based on Webpage DOM Tree Comparison

The Detection and Defense Mechanism for SQL Injection Attack Based on Web Application

SQL Injection and Code Defence

Vulnerability Detection System Based on Taint Range Propagation Analysis

SQL Injection Detection via Program Tracing and Machine Learning.

A Detective Tool Against Sql Injection Attacks Based on Static Analysis and Dynamic Monitor

Security Vulnerability Detection Study Based on Static Analysis

An algorithm for detecting SQL injection vulnerability using black-box testing