簡易檢索 / 詳目顯示

回結果列表
研究生： 馬若權
Roberto - Migli
論文名稱： A fast, multi-platform method to detect SQL Injection Attacks
A fast, multi-platform method to detect SQL Injection Attacks
指導教授： 洪西進
Shi-Jinn Horng
口試委員: 陳秋華
Chyou-hwa Chen
王毓饒
Yuh-Rau Wang
學位類別： 碩士
Master
系所名稱： 電資學院 - 資訊工程系
Department of Computer Science and Information Engineering
論文出版年： 2009
畢業學年度： 97
語文別： 英文
論文頁數： 51
外文關鍵詞： security, sql injection
相關次數： 點閱：184  下載：0 
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報
  •  上一筆

    • In these years SQL injection attacks became a major threat for both small and large web sites. This special kind of injection attack exploits vulnerabilities in the web applications that interact with a backend database. In this paper we analyze the SQL injection attack patterns and the previously proposed defense methods. We found that most of the existing researches are able to detect most of the attacks, but they do not consider the complexity involved in using the defense system and the eventual cost of modification of the original program. The proposed method requires no modification of the web application code, and can be adapted to different usage scenarios, involving also different operating systems and server applications. The proposed method is able to detect all the known injection points for the test application. We compare the results achieved with a published paper under the same testing conditions.

    In these years SQL injection attacks became a major threat for both small and large web sites. This special kind of injection attack exploits vulnerabilities in the web applications that interact with a backend database. In this paper we analyze the SQL injection attack patterns and the previously proposed defense methods. We found that most of the existing researches are able to detect most of the attacks, but they do not consider the complexity involved in using the defense system and the eventual cost of modification of the original program. The proposed method requires no modification of the web application code, and can be adapted to different usage scenarios, involving also different operating systems and server applications. The proposed method is able to detect all the known injection points for the test application. We compare the results achieved with a published paper under the same testing conditions.

    Acknowledgment i Abstract ii Table of Contents iii List of Figures v List of Tables vi Chapter 1 Introduction 1 1.1 Motivation: the relevance of SQL injection attacks 1 1.2 Research focus and contributions 2 1.3 Structure of the work 2 Chapter 2 Background 3 2.1 Computer security: terminologies and definitions 3 2.2 Computer Security paradigms: C.I.A. and A.A.A. 4 2.2.1 The C.I.A. triad 4 2.2.2 The A.A.A. paradigm 4 2.3 Computer Security vulnerabilities and threats 5 2.4 Introduction to Web Applications anatomy 6 2.5 Server Technologies 7 2.6 Web application security vulnerabilities 10 Chapter 3 SQL Injection Attacks 12 3.1 A basic SQLi example 13 3.2 SQLi techniques 15 3.2.1 Tautologies 16 3.2.2 Logically incorrect queries 16 3.2.3 Union queries 18 3.2.4 Piggy-Backed (stacked) queries 18 3.2.5 Stored Procedures 19 3.2.6 Blind SQL injection 20 3.2.7 Alternate Encodings 20 3.2.8 Timing Attacks 21 3.3 SQL injection prevention techniques 22 3.3.1 Statement preparation and Argument Binding 23 3.3.2 Static analysis 23 3.3.3 Dynamic and black-box analysis 24 3.3.4 Combined Static and Dynamic analysis 25 3.3.5 Taint-based techniques 25 3.3.6 SQL code randomization 26 3.3.7 Security oriented paradigms for Dynamic Queries 26 Chapter 4 Proposed Method 27 4.1 System Architecture 28 4.1.1 Learning phase 31 4.1.2 Testing phase 33 4.1.3 Monitoring phase 34 4.2 Testing of the detection program 35 4.2.1 Automated injection test: registration form 36 4.2.2 Automated injection test: search form 37 4.2.3 Manual injection attack 1 38 4.2.4 Manual injection attack 2 39 4.2.5 Manual injection attack 3 39 Chapter 5 Conclusions and future work 41 References 42

    [1] NSTISSC, "National Information Systems Security (INFOSEC) Glossary", http://security.isu.edu/pdf/4009.pdf
    [2] J. Vollbrecht, P. Calhoun, S. Farrell, L. Gommans, G. Gross , B. de Bruijn, C. de Laat, M. Holdrege, and D. Spence, AAA Framework, IETF RFC 2904, 2000; http://www.ietf.org/rfc/rfc2904.txt
    [3] NIST, Risk Management Guide for Information Technology Systems, 2001;
    [4] M. E. Whitman, "Enemy at the gate: threats to information security", Communications of the ACM, vol. 46, pp. 91-95, 2003.
    [5] N. Yeager and R. McGrath, Web server technology: Morgan Kaufmann, 1996.
    [6] Netcraft, "Internet Research, Anti-Phishing and PCI Security Services", http://news.netcraft.com/
    [7] M. Schauer, "DBMS market shares from 1990 to 2007", white paper, JoinVision E-Services GmbH, 2007; http://www.joinvision.com/jv/ext/infow/itfacts/200710/itfacts200710_en.pdf
    [8] OWASP Foundation, "OWASP Foundation's website", http://www.owasp.org
    [9] J. Grossman, "The Impending Threat and the Best Defense", white paper, http://net-security.org/dl/articles/WHXSSThreats.pdf
    [10] Z. Su and G. Wassermann, "The essence of command injection attacks in web applications", in Symposium on Principles of Programming Languages, 2006, pp. 372-382.
    [11] Oracle, "Oracle Database PL/SQL Language Reference - Using Dynamic SQL", http://download.oracle.com/docs/cd/B28359_01/appdev.111/b28370/dynamic.htm
    [12] T. Berners-Lee, R. Fielding, U. Irvine, and L. Masinter, Uniform Resource Identifiers (URI): Generic Syntax, IETF RFC 2396, 1998; http://www.ietf.org/rfc/rfc2396.txt
    [13] S. Kals, E. Kirda, C. Kruegel, and N. Jovanovic, "SecuBat: a web vulnerability scanner", in Proceedings of the 15th international conference on World Wide Web, 2006, pp. 247-256.
    [14] B. Damele, "sqlmap, a SQL Injection Tool", 2009; http://sqlmap.sourceforge.net/
    [15] O. Maor and A. Shulman, "Sql injection signatures evasion", white paper, http://www.imperva.com/resources/adc/sql_injection_signatures_evasion.html
    [16] W. Halfond, J. Viegas, and A. Orso, "A classification of SQL-injection attacks and countermeasures", in Proceedings of the IEEE International Symposium on Secure Software Engineering, 2006.
    [17] W. Halfond, A. Orso, and P. Manolios, "WASP: Protecting Web applications using positive tainting and syntax-aware evaluation", IEEE Transactions on Software Engineering, vol. 34, pp. 65-81, 2008.
    [18] MySQL AB "Mysql Information Functions", http://dev.mysql.com/doc/refman/4.1/en/information-functions.html#function_current-user
    [19] "PHP: Magic Quotes", 2009; http://www.php.net/magic_quotes
    [20] C. Schiflett, "addslashes() Versus mysql_real_escape_string()", blog, 22 Jan. 2006; http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
    [21] C. Anley, "(more) Advanced SQL Injection", white paper, http://www.ngssoftware.com/papers/more_advanced_sql_injection.pdf
    [22] Y. Kosuga, K. Kernel, M. Hanaoka, M. Hishiyama, and Y. Takahama, "Sania: Syntactic and Semantic Analysis for Automated Testing against SQL Injection", in Computer Security Applications Conference, 2007, pp. 107-117.
    [23] C. Gould, Z. Su, and P. Devanbu, "JDBC checker: A static analysis tool for SQL/JDBC applications", in Proceedings of the 26th International Conference on Software Engineering, 2004, pp. 697-698.
    [24] G. Wassermann and Z. Su, "An analysis framework for security in Web applications", in Proceedings of the FSE Workshop on Specification and Verification of Component-Based Systems, 2004, pp. 70?8.
    [25] Paros, "Parosproxy.org - Web Application Security", 2009; http://www.parosproxy.org/
    [26] Y. Huang, S. Huang, T. Lin, and C. Tsai, "Web application security assessment by fault injection and behavior monitoring", in Proceedings of the 12th international conference on World Wide Web, 2003, pp. 148-159.
    [27] G. Buehrer, B. W. Weide, and P. A. G. Sivilotti, "Using parse tree validation to prevent SQL injection attacks", in Proceedings of the 5th international workshop on Software engineering and middleware, 2005, pp. 106-113.
    [28] W. Halfond and A. Orso, "AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks", in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, 2005, pp. 174-183.
    [29] V. Livshits and M. Lam, "Finding security vulnerabilities in Java applications with static analysis", in Proceedings of the 14th Usenix Security Symposium, 2005, pp. 271-286.
    [30] CPAN, "perlsec - Perl Security", http://search.cpan.org/~nwclark/perl-5.8.9/pod/perlsec.pod
    [31] T. Pietraszek and C. V. Berghe, "Defending against injection attacks through context-sensitive string evaluation", in Eighth International Symposium on Recent Advances in Intrusion Detection, 2005, pp. 124-145.
    [32] S. W. Boyd and A. D. Keromytis, "SQLrand: Preventing SQL injection attacks", in Proceedings of the 2nd Applied Cryptography and Network Security (ACNS) Conference, 2004, pp. 292-302.
    [33] R. McClure and I. Kruger, "SQL DOM: compile time checking of dynamic SQL statements", in Proceedings of the 27th international conference on Software engineering, 2005, pp. 88-96.
    [34] A. Nguyen-Tuong, S. Guarnieri, D. Greene, and D. Evans, "Automatically hardening web applications using precise tainting", in 20th IFIP International Information Security Conference Makuhari-Messe, Chiba, Japan, 2005, pp. 296-307.
    [35] F. Valeur, D. Mutz, and G. Vigna, "A learning-based approach to the detection of sql attacks", 2003.
    [36] P. M. Hallam-Baker and B. Behlendorf, Extended Log File Format World Wide Web Consortium (W3C) recommendation, 1996; http://www.w3.org/TR/WD-logfile
    [37] MySQL AB, "MySQL 5.1 Reference Manual - The General Query Log", 2009; http://dev.mysql.com/doc/refman/5.1/en/query-log.html
    [38] InterSect Alliance, "Snare Epilog for Windows", http://www.intersectalliance.com/projects/EpilogWindows/
    [39] M. Owens, The definitive guide to SQLite: Apress, 2006.
    [40] SecurityFocus, "PHP-Nuke Multiple Module SQL Injection Vulnerabilities", http://www.securityfocus.com/bid/9544/info

    QR CODE