Abstract:SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database-driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV). This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object-oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

A Method for Detecting Code Security Vulnerability Based on Variables Tracking with Validated-Tree

Test Method on Code Injection Vulnerabilities of Web Application

SQL Injection Vulnerability Detection Based on Webpage DOM Tree Comparison

Exploring Defense of SQL Injection Attack in Penetration Testing

The Detection and Defense Mechanism for SQL Injection Attack Based on Web Application

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system

Design and implementation of a web application vulnerability detection system

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Supporting secure programming in web applications through interactive static analysis.

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

Detecting security vulnerabilities with vulnerability nets

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Web Vulnerability Scanning Software

Automated Vulnerability Detection Using Deep Learning Technique

Vulnerability Detection System Based on Taint Range Propagation Analysis

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

A Detective Tool Against Sql Injection Attacks Based on Static Analysis and Dynamic Monitor

Dynamic Analysis and Debugging of Binary Code for Security Applications

An algorithm for detecting SQL injection vulnerability using black-box testing