A Static Analysis Framework For Detecting SQL Injection Vulnerabilities
- 1 July 2007
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Annual International Computer Software and Applications Conference (COMPSAC)
- Vol. 1 (07303157) , 87-96
- https://doi.org/10.1109/compsac.2007.43
Abstract
Recently SQL injection attack (SIA) has become a major threat to Web applications. Via carefully crafted user input, attackers can expose or manipulate the back-end database of a Web application. This paper proposes the construction and outlines the design of a static analysis framework (called SAFELI) for identifying SIA vulnerabilities at compile time. SAFELI statically inspects MSIL bytecode of an ASP.NET Web application, using symbolic execution. At each hotspot that submits SQL query, a hybrid constraint solver is used to find out the corresponding user input that could lead to breach of information security. Once completed, SAFELI has the future potential to discover more delicate SQL injection attacks than black-box Web security inspection tools.Keywords
This publication has 10 references indexed in Scilit:
- Automatically generating malicious disks using symbolic executionPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2006
- AMNESIAPublished by Association for Computing Machinery (ACM) ,2005
- RAILPublished by Association for Computing Machinery (ACM) ,2005
- Symbolic model checking: 1020 States and beyondPublished by Elsevier ,2004
- JDBC checker: a static analysis tool for SQL/JDBC applicationsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2004
- SQLrand: Preventing SQL Injection AttacksPublished by Springer Nature ,2004
- Countering code-injection attacks with instruction-set randomizationPublished by Association for Computing Machinery (ACM) ,2003
- Web application security assessment by fault injection and behavior monitoringPublished by Association for Computing Machinery (ACM) ,2003
- Graph-Based Algorithms for Boolean Function ManipulationIEEE Transactions on Computers, 1986
- Symbolic execution and program testingCommunications of the ACM, 1976