Eliminating SQL Injection Attacks - A Transparent Defense Mechanism

This article presents an approach for retrofitting existing Web applications with run-time protection against known, as well as unseen, SQL injection attacks (SQLIAs) without the involvement of application developers. The precision of the approach is also enhanced with a method for reducing the rate of false positives in the SQLIA detection logic, via runtime discovery of the developers’ intention for individual SQL statements made by Web applications. The proposed approach is implemented in the form of protection mechanisms for J2EE, ASP.NET, and ASP applications. Named SQLPrevent, these mechanisms intercept HTTP requests and SQL statements, mark and track parameter values originating from HTTP requests, and perform SQLIA detection and prevention on the intercepted SQL statements. The AMNESIA testbed is extended to contain false-positive testing traces, and is used to evaluate SQLPrevent. In our experiments, SQLPrevent produced no false positives or false negatives, and imposed a maximum 3.6% performance overhead with 30 milliseconds response time for the tested applications.

Download Full-text

Implementation of AES-128 and Token-Base64 to Prevent SQL Injection Attacks via HTTP

International Journal of Advanced Trends in Computer Science and Engineering ◽

10.30534/ijatcse/2020/60932020 ◽

2020 ◽

Vol 9 (3) ◽

pp. 2876-2882

Author(s):

Muhammad Farras Muttaqin

Keyword(s):

Sql Injection ◽

Injection Attacks ◽

Sql Injection Attacks

Download Full-text

SQL Injection Attacks

Securing SQL Server ◽

10.1016/b978-1-59-749947-7.00008-3 ◽

2013 ◽

pp. 221-247

Author(s):

Denny Cherry

Keyword(s):

Sql Injection ◽

Injection Attacks ◽

Sql Injection Attacks

Download Full-text

Detection and Prevention of SQL Injection Attacks Using Semantic Equivalence

Communications in Computer and Information Science - Computer Networks and Intelligent Computing ◽

10.1007/978-3-642-22786-8_13 ◽

2011 ◽

pp. 103-112 ◽

Cited By ~ 3

Author(s):

Sandeep Nair Narayanan ◽

Alwyn Roshan Pais ◽

Radhesh Mohandas

Keyword(s):

Sql Injection ◽

Semantic Equivalence ◽

Injection Attacks ◽

Sql Injection Attacks

Download Full-text

Efficiently-Enabled Inclusive Approach Preventing SQL Injection Attacks

Computer Networks and Information Technologies - Communications in Computer and Information Science ◽

10.1007/978-3-642-19542-6_79 ◽

2011 ◽

pp. 421-423

Author(s):

Abhijot Singh Mann ◽

Sheela Jain

Keyword(s):

Sql Injection ◽

Injection Attacks ◽

Inclusive Approach ◽

Sql Injection Attacks

Download Full-text

SQL Injection Attacks Countermeasures

Threats, Countermeasures, and Advances in Applied Information Security - Advances in Information Security, Privacy, and Ethics ◽

10.4018/978-1-4666-0978-5.ch010 ◽

2012 ◽

pp. 194-213

Author(s):

Kasra Amirtahmasebi ◽

Seyed Reza Jalalinia

Keyword(s):

Web Application ◽

Web Applications ◽

Confidential Information ◽

Sql Injection ◽

Unauthorized Access ◽

Injection Attacks ◽

Prevention Techniques ◽

Sql Injection Attack ◽

Sql Injection Attacks ◽

The Web

Due to the huge growth in the need for using Web applications worldwide, there have been huge efforts from programmers to develop and implement new Web applications to be used by companies. Since a number of these applications lack proper security considerations, malicious users will be able to gain unauthorized access to confidential information of organizations. A concept called SQL Injection Attack (SQLIA) is a prevalent method used by attackers to extract the confidential information from organizations’ databases. They work by injecting malicious SQL codes through the web application, and they cause unexpected behavior from the database. There are a number of SQL Injection detection/prevention techniques that must be used in order to prevent unauthorized access to databases.

Download Full-text