SQL Injections

SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit a security vulnerability in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research. The articles cited here focus on prevention, detection, and testing.

• Srivastava, Mahima, "Algorithm to Prevent Back End Database Against SQL Injection Attacks," Computing for Sustainable Global Development (INDIA Com), 2014 International Conference on, vol., no., p.754, 757, 5-7 March 2014. (ID#:14-1797) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6828063&isnumber=6827395 SQL injection attack (SQLIA) is a technique through which attackers gain access over back-end databases by inserting the malicious codes through front-end. In recent times SQL injection attacks (SQLIAs) have emerged as a major threat to database security. Flaws in designing, improper coding practices, configuration errors, improper validation of user input etc. makes the web application vulnerable and allows the malicious user to obtain unrestricted access to confidential information. Researchers have proposed so many solutions but still SQLIAs exist. In this paper we will discuss several types of SQLIAs, existing techniques and their drawbacks. Finally I have proposed a solution using the ASCII values. I have implemented it using C# and SQL server 2005, although this algorithm can be implemented in any language and for any database platform with minimal modifications. Keywords: Arrays; Authentication; Databases; Encoding; Internet; Servers; ASCII values; SQL injections; SQL query; cyber crime; run time monitoring

• Khanuja, H.; Suratkar, S.S., ""Role of Metadata In Forensic Analysis Of Database Attacks"," Advance Computing Conference (IACC), 2014 IEEE International , vol., no., pp.457,462, 21-22 Feb. 2014. (ID#:14-1798) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6779367&isnumber=6779283 With the spectacular increase in online activities like e-transactions, security and privacy issues are at the peak with respect to their significance. Large numbers of database security breaches are occurring at a very high rate on daily basis. So, there is a crucial need in the field of database forensics to make several redundant copies of sensitive data found in database server artifacts, audit logs, cache, table storage etc. for analysis purposes. Large volume of metadata is available in database infrastructure for investigation purposes but most of the effort lies in the retrieval and analysis of that information from computing systems. Thus, in this paper we mainly focus on the significance of metadata in database forensics. We proposed a system here to perform forensics analysis of database by generating its metadata file independent of the DBMS system used. We also aim to generate the digital evidence against criminals for presenting it in the court of law in the form of who, when, why, what, how and where did the fraudulent transaction occur. Thus, we are presenting a system to detect major database attacks as well as anti-forensics attacks by developing an open source database forensics tool. Eventually, we are pointing out the challenges in the field of forensics and how these challenges can be used as opportunities to stimulate the areas of database forensics. Keywords: data privacy; digital forensics; law; meta data; antiforensics attacks; audit logs; cache; court of law; database attacks; database security breaches; database server artifacts; digital evidence; e-transactions; forensic analysis; fraudulent transaction information analysis; information retrieval; metadata; online activities; open source database forensics tool; privacy issue; security issue ;table storage; Conferences; Handheld computers; Database forensics; SQL injection; anti-forensics attacks; digital notarization; linked hash technique; metadata; reconnaissance attack; trail obfuscation

• Antunes, N.; Vieira, M., "Penetration Testing for Web Services," Computer , vol.47, no.2, pp.30,36, Feb. 2014. (ID#:14-1799) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6681866&isnumber=6756723 Web services are often deployed with critical software security faults that open them to malicious attack. Penetration testing using commercially available automated tools can help avoid such faults, but new analysis of several popular testing tools reveals significant failings in their performance. The Web extra at http://youtu.be/COgKs9e679o is an audio interview in which authors Nuno Antunes and Marco Vieira describe how their analysis of popular testing tools revealed significant performance failures and provided important insights for future improvement. Keywords: Web services; program testing; safety-critical software; security of data; Web services; commercially available automated tools; critical software security faults; malicious attack; penetration testing; Computer security; Computer viruses; Runtime; Simple object access protocol; Software testing; Web and internet services; SQL injection; Web security scanners; Web services; code vulnerabilities; command injection; penetration testing; vulnerability detection

• Bozic, Josip; Wotawa, Franz, "Security Testing Based on Attack Patterns," Software Testing, Verification and Validation Workshops (ICSTW), 2014 IEEE Seventh International Conference on , vol., no., pp.4,11, March 31 2014-April 4 2014. (ID#:14-1800) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6825631&isnumber=6825623 Testing for security related issues is an important task of growing interest due to the vast amount of applications and services available over the internet. In practice testing for security often is performed manually with the consequences of higher costs, and no integration of security testing with today's agile software development processes. In order to bring security testing into practice, many different approaches have been suggested including fuzz testing and model-based testing approaches. Most of these approaches rely on models of the system or the application domain. In this paper we suggest to formalize attack patterns from which test cases can be generated and even executed automatically. Hence, testing for known attacks can be easily integrated into software development processes where automated testing, e.g., for daily builds, is a requirement. The approach makes use of UML state charts. Besides discussing the approach, we illustrate the approach using a case study. Keywords: Adaptation models; Databases; HTML; Security; Software; Testing; Unified modeling language; Attack pattern; SQL injection; UML state machine; cross-site scripting; model-based testing; security testing

• Fonseca, Jose; Seixas, Nuno; Vieira, Marco; Madeira, Henrique, "Analysis of Field Data on Web Security Vulnerabilities," Dependable and Secure Computing, IEEE Transactions on , vol.11, no.2, pp.89,100, March-April 2014. (ID#:14-1801) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6589556&isnumber=6785951 Most web applications have critical bugs (faults) affecting their security, which makes them vulnerable to attacks by hackers and organized crime. To prevent these security problems from occurring it is of utmost importance to understand the typical software faults. This paper contributes to this body of knowledge by presenting a field study on two of the most widely spread and critical web application vulnerabilities: SQL Injection and XSS. It analyzes the source code of security patches of widely used web applications written in weak and strong typed languages. Results show that only a small subset of software fault types, affecting a restricted collection of statements, is related to security. To understand how these vulnerabilities are really exploited by hackers, this paper also presents an analysis of the source code of the scripts used to attack them. The outcomes of this study can be used to train software developers and code inspectors in the detection of such faults and are also the foundation for the research of realistic vulnerability and attack injectors that can be used to assess security mechanisms, such as intrusion detection systems, vulnerability scanners, and static code analyzers. Keywords: Awards activities; Blogs; Internet; Java; Security; Software; Internet applications; Security; languages; review and evaluation

• Hamdi, Mohammed; Safran, Mejdl; Hou, Wen-Chi, "A Security Novel for a Networked Database," Computational Science and Computational Intelligence (CSCI), 2014 International Conference on , vol.1, no., pp.279,284, 10-13 March 2014. (ID#:14-1802) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6822122&isnumber=6822065 The security of databases is an important characteristic for database systems. It is intended to protect data from unauthorized access, damage or loss. With the advance of the methods of penetration and piracy, and with the increased reliance on databases that are connected with the Internet, the protection of databases has become one of the challenges faced by various emerging institutions, especially with the increasing of electronic crimes and thefts. In light of this, the focus is on analyzing and reviewing the cryptosystem architecture for networked databases. In this paper, we will discuss the process of encryption and decryption at the application and storage levels. Moreover, strategies of encryption inside the database by using the property of Transparent Data Encryption will be addressed. These methods will give a clear analysis of how data stored in databases can be protected and secured over the network. Additionally, these methods will help to overcome problems that are usually faced by administrative beginners, who work in the enterprises and manage their databases. Finally, we will discuss SQL injection, as a database attack and present the techniques of defense that prevent the adversaries from attacking the database. Keywords: Ciphers; Databases; Encryption; Public key; Servers; Cryptography; Database; SQL; Security

• Alqahtani, Saeed M.; Balushi, Maqbool Al; John, Robert, "An Intelligent Intrusion Prevention System for Cloud Computing (SIPSCC)," Computational Science and Computational Intelligence (CSCI), 2014 International Conference on , vol.2, no., pp.152,158, 10-13 March 2014. (ID#:14-1803) Available at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6822321&isnumber=6822285 Cloud computing is a fast growing IT model for the exchange and delivery of different services through the Internet. However there is a plethora of security concerns in cloud computing which still need to be tackled (e.g. confidentiality, auditability and Privileged User Access). To detect and prevent such issues, the Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) are effective mechanism against attacks such as SQL Injection. This study proposes a new service of IPS that prevents SQL injections when it comes over cloud computing website (CCW) using signature-based devices approach. A model has been implemented on three virtual machines. Through this implementation, a service-based intrusion prevention system in cloud computing (SIPSCC) is proposed, investigated and evaluated from three perspectives the vulnerability detection, average time, and false positives. Keywords: Cloud computing; Databases; Educational institutions; Intrusion detection; Servers; SIPSCC; CCW; IDS; IPS; Open Source Hostbased Intrusion Detection System (OSSEC)

• Al-Sakib Khan Pathan, Diallo Abdoulaye Kindy, "Lethality of SQL Injection Against Current And Future Internet Technologies," International Journal of Computational Science and Engineering archive Volume 9 Issue 4, April 2014, (Pages 386-394). (ID#:14-1804) Available at: http://dl.acm.org/citation.cfm?id=2630009.2630019&coll=DL&dl=GUIDE&CFID=485004180&CFTOKEN=38695484 or http://dx.doi.org/10.1504/IJCSE.2014.060720 SQL injection attack is often used as the underlying technology for hacking, which has made significant number of news headlines in recent years. A vast majority of the readers do not have a clear idea how SQL injection attack is used for hacking. In this article, we analyze this technology from necessary angles and discuss how this could be a significant potential threat for the future web and internet technologies. Keyword: SQL injection

• Michael Marcozzi, Wim Vanhoof, Jean-Luc Hainaut, "Towards Testing Of Full-Scale SQL Applications Using Relational Symbolic Execution," CSTVA 2014 Proceedings of the 6th International Workshop on Constraints in Software Testing, Verification, and Analysis, May 2014, (Pages 12-17). (ID#:14-1805) Available at: http://dl.acm.org/citation.cfm?id=2593735.2593738&coll=DL&dl=GUIDE&CFID=485004180&CFTOKEN=38695484 or http://dx.doi.org/10.1145/2593735.2593738 Constraint-based testing is an automatic test case generation approach where the tested application is transformed into constraints whose solutions are adequate test data. In previous work, we have shown that this technique is particularly well-suited for testing SQL applications, as the semantics of SQL can be naturally transformed into standard SMT constraints, using so-called relational symbolic execution. In particular, we have demonstrated such testing to be possible in practice with current solver techniques for small-scale applications. In this work, we identify the main challenges and provide research directions towards constraint-based testing of full-scale SQL applications. We investigate the additional research work needed to integrate relational and dynamic symbolic execution, handle properly dynamic SQL, generate tractable SMT constraints for most SQL applications, detect SQL runtime errors and deal with non-deterministic SQL. Keywords: Databases, Fault localization, Quantifiers, SMT solvers, SQL, Symbolic execution, Test data generation

• Anton V. Uzunov, Eduardo B. Fernandez, "An Extensible Pattern-Based Library And Taxonomy Of Security Threats For Distributed Systems," Computer Standards & Interfaces, Volume 36 Issue 4, June, 2014, ( Pages 734-747). (ID#:14-1806) Available at: http://dl.acm.org/citation.cfm?id=2588915.2589309&coll=DL&dl=GUIDE&CFID=485004180&CFTOKEN=38695484 or http://dx.doi.org/10.1016/j.csi.2013.12.008 Security is one of the most essential quality attributes of distributed systems, which often operate over untrusted networks such as the Internet. To incorporate security features during the development of a distributed system requires a sound analysis of potential attacks or threats in various contexts, a process that is often termed ''threat modeling''. To reduce the level of security expertise required, threat modeling can be supported by threat libraries (structured or unstructured lists of threats), which have been found particularly effective in industry scenarios; or attack taxonomies, which offer a classification scheme to help developers find relevant attacks more easily. In this paper we combine the values of threat libraries and taxonomies, and propose an extensible, two-level ''pattern-based taxonomy'' for (general) distributed systems. The taxonomy is based on the novel concept of a threat pattern, which can be customized and instantiated in different architectural contexts to define specific threats to a system. This allows developers to quickly consider a range of relevant threats in various architectural contexts as befits a threat library, increasing the efficacy of, and reducing the expertise required for, threat modeling. The taxonomy aims to classify a wide variety of more abstract, system- and technology-independent threats, which keeps the number of threats requiring consideration manageable, increases the taxonomy's applicability, and makes it both more practical and more useful for security novices and experts alike. After describing the taxonomy which applies to distributed systems generally, we propose a simple and effective method to construct pattern-based threat taxonomies for more specific system types and/or technology contexts by specializing one or more threat patterns. This allows for the creation of a single application-specific taxonomy. We demonstrate our approach to specialization by constructing a threat taxonomy for peer-to-peer systems. Keywords: Distributed systems security attacks, Pattern-based security threat taxonomy, Peer-to-peer system-specific threats, Threat modeling, Threat patterns

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.