The SQL Injection Vulnerability Detection of the Web Application

Abstract:

the SQL injection is one of the common security vulnerabilities of the Web application. This paper studies how to find out the possible SQL injection vulnerabilities. The scheme this paper put forward is the technology of black-box test. The main steps are that firstly construct specific user input in the test period of the Web application system, and inject it into the application system, then get the vulnerability detection report according to the analysis of the test logs.

• Periodical: Applied Mechanics and Materials (Volumes 198-199)
• Pages: 1457-1461
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.198-199.1457
• Online since: September 2012
• Authors: You Chan Zhu, Hui Li Liang
• Keywords: Black Box Testing, SQL Injection, Web Application

References

[1] Chris Anley. Advanced SQL injection in SQL Server Application http: /www. ngssoftware. com/papers.

[2] M. Muthuprasanna, Ke Wei, Suraj Kothari . Eliminating SQL Injection Attacks-A Transparent Defense Mechanism. Eight IEEE International Symposium on Web Site Evolution, (2006).

DOI: 10.1109/wse.2006.9

[3] Abdul Razzaq, Ali Hur, Nasir Haider, Faroop Ahmad . Multi-Layered Defense against Web Application Attacks. Proceedings of the 2009 Sixth International Conference on Information Technology: New Generations, (2009).

DOI: 10.1109/itng.2009.77

[4] Xiang Fu, XinLu, Boris Peltsverger Shijun Chen . A Static Analysis Framework For Detecting SQL Injection Vulnerabilities. 31st Annual Internatonal Computer Software and Application Conference (2007).

DOI: 10.1109/compsac.2007.43

[5] Arjin Dasgupta, Vivek Narasayya, Manoj Syamala . A Static Analysis Framework for Database Application . IEEE Internatonal Conference on Data Engineering (2009).

DOI: 10.1109/icde.2009.98

[6] YuJing，Gao Feng，XuLianghua，ZhuLuhua . The study of the permeability test based on the SQL injection. Computer Engineering and Design, in August (2007).

[7] Yang Haixia, Nan Zhihong. A Database Security Testing Scheme of Web Application. Computer Science & Education (2009).

DOI: 10.1109/iccse.2009.5228560

[8] Nuno Antunes, Marco Vieira . Detecting SQL Injection Vulnerabilities in Web Services. Fourth Latin American Symposium on Dependable Computing, (2009).

DOI: 10.1109/ladc.2009.21

[9] Massimo Ficco, Luigi Coppolino et al . A Weight-Based Symptom Correlation Approach to SQL Injection Attacks. Fourth Latin-American Symposium on Dependable Computing, (2009).

DOI: 10.1109/ladc.2009.14

[10] ZhouJingli，WangXiaofeng etc . A new study and implemention of the reverse SQL injection strategy. Computer Science，2006 33(11).

[11] Chris Anley. (more)Advanced SQL Injection. http: /www. ngssoftware. com/papers.