Analysis & Detection of SQL Injection Vulnerabilities via Automatic Test Case Generation of Programs

Abstract

SQL injection attacks occur due to vulnerabilities in the design of queries where a malicious user can take advantage of input opportunities to insert code in the queries that modify the query-conditions resulting in unauthorized database access. We provide a novel technique to identify the possibilities of such attacks. The central theme of our technique is based on automatically developing a model for a SQL query such that the model captures the dependencies between various components (sub-queries) of the query. We, then, analyze the model using CREST test-case generator and identify the conditions under which the query corresponding to the model is deemed vulnerable. We further analyze the obtained conditionset to identify its subset; this subset being referred to as the causal set of the vulnerability. Our technique considers the semantics of the query conditions, i.e., the relationship between the conditions, and as such complements the existing techniques which only rely on syntactic structure of the SQL query. In short, our technique can detect vulnerabilities in nested SQL queries, and can provide results with no false positives or false negatives when compared to the existing techniques.

Fatal injection: a survey of modern code injection attack countermeasures

“…If a defect is detected, an attack is replayed by the tool to developers. Ruse, Sarkar & Basu (2010) detect SQL injection vulnerabilities in a similar manner. In addition, Rubyx (Chaudhuri & Foster, 2010) follows a similar approach to counter JavaScript injection attacks in applications written in Ruby.…”

A Survey on the Detection of SQL Injection Attacks and Their Countermeasures

“…Case Generation of Programs" [12] Ruse et al [12] have proposed an approach that uses automatic test case generation to detect SQL injection vulnerabilities. The main idea behind this framework is based on creating a specific model that deals with SQL queries automatically.…”

“…10 Ruse et al [12] Idea behind this framework is based on creating a specific model that deals with SQL queries automatically.…”

Goal-oriented dynamic test generation

“…[23], CREST has been used by several research groups. For instance, CREST has been used to build tools for regression testing [139], for detecting SQL injection vulnerabilities [118], and for identifying infeasible code to achieve high structural coverage [12], and has been modified to run distributed on a cluster for testing a flash storage platform [81]. In the development of this research project, we also used CREST for structural coverage testing and security testing.…”