Detection and Prevention of SQL Injection Attacks
نویسندگان
چکیده
We depend on database-driven web applications for an ever increasing amount of activities, such as banking and shopping. When performing such activities, we entrust our personal information to these web applications and their underlying databases. The confidentiality and integrity of this information is far from guaranteed; web applications are often vulnerable to attacks, which can give an attacker complete access to the application's underlying database. SQL injection is a type of code-injection attack in which an attacker uses specially crafted inputs to trick the database into executing attacker-specified database commands. In this chapter, we provide an overview of the various types of SQL injection attacks and present AMNESIA, a technique for automatically detecting and preventing SQL injection attacks. AMNESIA uses static analysis to build a model of the legitimate queries an application can generate and then, at runtime, checks that all queries generated by the appUcation comply with this model. We also present an extensive empirical evaluation of AMNESIA. The results of our evaluation indicate that AMNESIA is, at least for the cases considered, highly effective and efficient in detecting and preventing SQL injection attacks.
منابع مشابه
Survey and Comparative Analysis of SQL Injection Attacks, Detection and Prevention Techniques for Web Applications Security
Web applications witnessed a rapid growth for online business and transactions are expected to be secure, efficient and reliable to the users against any form of injection attacks. SQL injection is one of the most common application layer attack techniques used today by hackers to steal data from organizations. It is a technique that exploits a security vulnerability occurring in the database l...
متن کاملA Novel Approach for SQL Injection Prevention Using Hashing & Encryption (SQL-ENCP)
SQL Injection Attack (SQLIA) is a technique that helps the attackers to direct enters into the database in an unauthorized way and reach the highest or most decisive point in extracting or updating sensitive information from any organizations database. In this paper, we studied the scenario of the different types of attacks with descriptions and examples of how attacks of that type could be per...
متن کاملComparison of SQL Injection Detection and Prevention Tools based on Attack Type and Deployment Requirements
SQL injection is a type of attack which the attacker adds Structured Query Language code to a web form input box to gain access or make changes to data. SQL injection vulnerability allows an attacker to flow commands directly to a web application's underlying database and destroy functionality or confidentiality. Researchers have proposed different tools to detect and prevent this vulnerability...
متن کاملAnalysis of SQL Injection Detection Techniques
SQL Injection is one of the vulnerabilities in OWASP’s Top Ten List for Web Based Application Exploitation. These types of attacks takes place on Dynamic Web applications as they interact with the databases for the various operations. Current Content Management System like Drupal, Joomla or Wordpress have all the information stored in their databases. A single intrusion into these types of webs...
متن کاملDetection and Prevention of SQL Injection Attacks on Web Applications
In this era where Internet has captured the world, level of security that this Internet provides has not grown as fast as the Internet application. Internet has eased the life of human in numerous ways, but defects such as intrusions that are attached with Internet applications keep on the growth of these applications. One such intrusion is the SQL Injection Attacks (SQLIA). In web applications...
متن کامل