Abstract:This work presents a gray‐box combinatorial security testing methodology for detecting SQL injection vulnerabilities in web applications. New attack grammars modelling SQL injections are proposed. This combinatorial security testing approach performs equally well or better when compared to existing state‐of‐the‐art SQL injection security testing tools. Summary This work presents an extended and enhanced gray‐box combinatorial security testing methodology for SQL injection vulnerabilities in web applications. We propose multiple new attack grammars modelling SQLi attacks against MySQL‐compatible databases, each one targeting a different injection context. Additionally, these grammars are also dynamically refined at the beginning of each attack against an endpoint of a web application, as a further optimization of the used attack model by taking into account the specifics of the generated query of that endpoint. Our goal is to enhance existing combinatorial approaches for detecting SQL injection vulnerabilities. The newly developed methodology is implemented in a prototype security testing tool called SQLInjector+, which is an extension of an earlier prototype developed by us in prior work. This improved tool can attack (i.e. test) any web application that uses a MySQL‐compatible database management system. We evaluate our revised approach and improved prototype tool in a case study comprising of different kinds of web applications to which SQLi is a potential security threat. The case study contains the well‐known verification framework WAVSEP among other five real‐world web applications and one web application firewall. Our generated attack vectors, constructed via combinatorial methods applied to our improved and dynamically optimized attack grammars, are capable of injecting every known vulnerable endpoint in WAVSEP and also of finding new vulnerable parameters in some of the real‐world applications investigated in this paper. Our approach performs equally well or better when compared with existing state‐of‐art of SQL injection security testing tools (sqlmap, w3af, wapiti and fuzzdb) across all tested web applications in the case study.

An Effective Penetration Test Approach Based on Feature Matrix for Exposing SQL Injection Vulnerability

Exposing SQL Injection Vulnerability Through Penetration Test Based on Finite State Machine

Exploring Defense of SQL Injection Attack in Penetration Testing

A Dynamic SQL Injection Vulnerability Test Case Generation Model Based on the Multiple Phases Detection Approach

An Inferential Metamorphic Testing Approach to Reduce False Positives in SQLIV Penetration Test

Attack Model Based Penetration Test for SQL Injection Vulnerability

Test Sql Injection Vulnerabilities In Web Applications Based On Structure Matching

Model-driven penetration test of the SQL injection in Web applications

ART4SQLi: The ART of SQL Injection Vulnerability Discovery

Test Method on Code Injection Vulnerabilities of Web Application

An algorithm for detecting SQL injection vulnerability using black-box testing

CMM: A Combination-Based Mutation Method for SQL Injection

Research on Mock Attack Testing for SQL Injection Vulnerability in Multi-Defense Level Web Applications

Research on SQL Injection Vulnerability Multi-level Detection Method

Combinatorial methods for dynamic gray‐box SQL injection testing

DeepSQLi: deep semantic learning for testing SQL injection

Injection Point Extraction Approach in SQL Injection Vulnerability under Web2.0 Environment

DIAVA: A Traffic-Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data

Research of the Fast Attack Method for the SQL Blind Injection

Design and Implementation of SQL Injection Vulnerability Scanning Tool

SQLUnitGen: Test Case Generation for SQL Injection Detection