Abstract
Nowadays, the security of applications and Web servers is a new trend that finds its need on the Web. The number of vulnerabilities identified in this type of applications is constantly increasing especially SQL injection attack. It is therefore necessary to regularly audit Web applications to verify the presence of exploitable vulnerabilities. Web vulnerability scanner WASAPY is one of the audit tool, it uses an algorithm which bases on a classification techniques of pages obtained by sending HTTP requests especially formatted. We propose in this paper a new algorithm which was built in a vision to improve rather to supplement the logic followed in modeling WASAPY tool. The tool was supplemented by a new class reflecting the legitimate appearance or referential, therefore, the detection mechanism was solidly built on a statistic in a fairly clear mathematical framework described by a simple geometric representation or interpretation.
Highlights
The Web server security is a recurring problem
The number of vulnerabilities identified in this type of software is constantly increasing, as described in particular in the document "The OWASP Ten Most Critical Web Application Security Risks" [4]
Criticism of WASAPY model a) The vision of security: The vision was bounded on the illegitimate part of the queries, which deprived the completeness of a model that could be very beneficial
Summary
The Web server security is a recurring problem. The number of vulnerabilities identified in this type of software is constantly increasing, as described in particular in the document "The OWASP Ten Most Critical Web Application Security Risks" [4]. There are two main classes of approaches adopted by most of the vulnerability Web scanners: Approach based on recognition of error messages in response pages, Approach based on studying similarity of pages returned by the server. We realize an approach for the detection of SQL injection attacks in Web applications, based on sending HTTP requests and analyzing the responses of the latter. This approach is based on two techniques: technique of recognition of error messages in response pages, and the study of similarity of pages returned by the server. The used request were extracted from OWASP (SQL Cheat Sheet) project [4]
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: International Journal of Advanced Computer Science and Applications
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
