Injection Vulnerabilities Research Articles

Detection of Wordpress Content Injection Vulnerability

The popularity of content management software (CMS) is growing vastly to the web developers and the business people because of its capacity for easy accessibility, manageability and usability of the distributed website contents. As per the statistics of Built with, 32% of the web applications are developed with WordPress(WP) among all other CMSs [1]. It is obvious that quite a good number of web applications were built with WP in version 4.7.0 and 4.7.1. A recent research reveals that content injection vulnerability was found available in the above two versions of WP [2]. Unauthorized content injection by an intruder in a CMS managed application is one of the serious problems for the business as well as for the web owner.Therefore, detection of the vulnerability becomes a critical issue for this time. In this paper, we have discussed about the root cause of WP content injection of the above versions and have also proposed a detection model for the given vulnerability. A tool, SAISAN has been implemented as per our anticipated model and conducted an examination on 176 WP developed web applications using SAISAN. We achieved the accuracy of 92% of the result of SAISAN as compared to manual black box testing outcome.

LDAP Vulnerability Detection in Web Applications

Lightweight Directory Access Protocol (LDAP) is commonly used in web applications to provide lookup information and enforcing authentication. Web applications may suffer from LDAP injection vulnerabilities that can lead to security breaches such as login bypass and privilege escalation. This paper1 proposes OCL fault injection-based detection of LDAP injection attacks. The authors extract design-level information and constraints expressed in OCL and then randomly alter them to generate test cases that have the capability to uncover LDAP injection vulnerabilities. The authors proposed approaches to implement test case generation, and they used one open source PHP application and one custom application to evaluate the proposed approach. The analysis shows that this approach can detect LDAP injection vulnerabilities.

SQL Injection Impact on Web Server and Their Risk Mitigation Policy Implementation Techniques: An Ultimate solution to Prevent Computer Network from Illegal Intrusion

SQL Injection attacks pose a very serious security threat to Web applications and web servers. They allow attackers to obtain unrestricted access to the databases underlying the applications and to the potentially sensitive and important information these databases contain. Although researchers and security professionals have proposed various methods to address the SQL injection problem but current approaches either fail to address the full scope of the problem or have limitations that prevent their use and adoption. Many researchers and security professionals are familiar with only a subset of the wide range of techniques available to attackers who are trying to take advantage of SQL injection vulnerabilities. As a result, many solutions proposed in the literature address only some of the issues related to SQL injection. To address this problem, we are presenting an extensive review of the different types of SQL injection attacks known to date. Also for each type of attack, we provide descriptions and examples of how attacks of that type could be performed. We also presented and analyze existing detection and prevention techniques against SQL injection attacks. Keywords:SQL injection attack, SQL queries, web application, DBMS, taxonomy, web application.

E-mail Header Injection Vulnerabilities

Abstract E-mail Header Injection vulnerability is a class of vulnerability that can occur in web applications that use user input to construct e-mail messages. E-mail Header Injection is possible when the mailing script fails to check for the presence of e-mail headers in user input (either form fields or URL parameters). The vulnerability exists in the reference implementation of the built-in mail functionality in popular languages such as PHP, Java, Python, and Ruby. With the proper injection string, this vulnerability can be exploited to inject additional headers, modify existing headers, and alter the content of the e-mail.

Security slicing for auditing common injection vulnerabilities

Abstract Cross-site scripting and injection vulnerabilities are among the most common and serious security issues for Web applications. Although existing static analysis approaches can detect potential vulnerabilities in source code, they generate many false warnings and source-sink traces with irrelevant information, making their adoption impractical for security auditing. One suitable approach to support security auditing is to compute a program slice for each sink, which contains all the information required for security auditing. However, such slices are likely to contain a large amount of information that is irrelevant to security, thus raising scalability issues for security audits. In this paper, we propose an approach to assist security auditors by defining and experimenting with pruning techniques to reduce original program slices to what we refer to as security slices, which contain sound and precise information. To evaluate the proposed approach, we compared our security slices to the slices generated by a state-of-the-art program slicing tool, based on a number of open-source benchmarks. On average, our security slices are 76% smaller than the original slices. More importantly, with security slicing, one needs to audit approximately 1% of the total code to fix all the vulnerabilities, thus suggesting significant reduction in auditing costs.

Neutralizing SQL Injection Attack Using Server Side Code Modification in Web Applications

Reports on web application security risks show that SQL injection is the top most vulnerability. The journey of static to dynamic web pages leads to the use of database in web applications. Due to the lack of secure coding techniques, SQL injection vulnerability prevails in a large set of web applications. A successful SQL injection attack imposes a serious threat to the database, web application, and the entire web server. In this article, the authors have proposed a novel method for prevention of SQL injection attack. The classification of SQL injection attacks has been done based on the methods used to exploit this vulnerability. The proposed method proves to be efficient in the context of its ability to prevent all types of SQL injection attacks. Some popular SQL injection attack tools and web application security datasets have been used to validate the model. The results obtained are promising with a high accuracy rate for detection of SQL injection attack.

Devising Solution to SQL Injection Attacks

Web application plays an important role in different fields like finance sector, business, shopping etc. There is no. of web application vulnerabilities such as SQL injection, Buffer overflow etc. Above these SQL Injection vulnerabilities are very harmful for web applications. In literature survey there are number of technique used to prevent SQLIA in application level, but not in database level. SQL injection attacks occur due to vulnerabilities in the design of queries where a malicious user can take advantage of input opportunities to insert code in the queries that modify the query-conditions resulting in unauthorized database access. In this paper we design an effective algorithm to prevent stored procedure from SQLIA in database level. Hirschberg‘s algorithm is used to prevent the stored procedure, which reduces both time as well as space complexity. We also analyse several aspects which have been discussed further.

Securing native XML database-driven web applications from XQuery injection vulnerabilities

Database-driven web applications today are XML-based as they handle highly diverse information and favor integration of data with other applications. Web applications have become the most popular way to deliver essential services to customers, and the increasing dependency of individuals on web applications makes them an attractive target for adversaries. The adversaries exploit vulnerabilities in the database-driven applications to craft injection attacks which include SQL, XQuery and XPath injections. A large amount of work has been done on identification of SQL injection vulnerabilities resulting in several tools available for the purpose. However, a limited work has been done so far for the identification of XML injection vulnerabilities and the existing tools only identify XML injection vulnerabilities which could lead to a specific type of attack. Hence, this work proposes a black-box fuzzing approach to detect different types of XQuery injection vulnerabilities in web applications driven by native XML databases. A prototype XQueryFuzzer is developed and tested on various vulnerable applications developed with BaseX as the native XML database. An experimental evaluation demonstrates that the prototype is effective against detection of XQuery injection vulnerabilities. Three new categories of attacks specific to XQuery, but not listed in OWASP are identified during testing.

Enhanced Pushdown Automaton based Static Analysis for Detection of SQL Injection Hotspots in Web Application

SQL injection Hotspots (SQLiHs) are Application’s Entry Points (AEPs) through which SQL injection is possible, subject to the application’s internal sanitization or validation capabilities. Since not all AEPs are SQLiHs, one serious challenge during testing of very large web application for detection of SQL Injection Vulnerabilities (SQLIVs) is how to reliably decide which AEPs to consider for the test and which AEPs are unnecessary? In this paper, we propose a new Pushdown Automaton (PDA) based static analysis technique for detection of SQLiHs in web applications. The goal is to produce concrete information that can reliably and confidently guide both human tester/developer and SQLIVs detection tools/techniques as to which part of the source code to concentrate their efforts during detection and fixing of SQL injection flaws in an application. The proposed technique is an integral part of an on-going research on automated method for detection and removal of SQLIVs in web application. Experimental evaluation of the method is in progress. However, preliminary results show that the proposed technique is both feasible and effective.

A systematic study of content security policy in web applications

Content Security Policy CSP is a popular and effective security mechanism against content injection vulnerabilities such as cross-site scripting for web applications. Unfortunately, there are many problems in analysis, design, and evaluation of CSP, which are hindering the wide adoption of CSP by real-world web applications. In this paper, we give a systematic study and propose workable solutions for these problems. We systemically analyze the methodology of CSP, namely how it works and prevents attacks. We present the security weaknesses in the methodology, namely which attacks it cannot prevent. We give the formalized definitions and proofs of the properties for theoretically accurate design and evaluation of CSP in web applications. We give a practical policy tool named ACSP to help developers or analysts to automatically design CSP with the best security and availability or exactly evaluate the security and availability of the used CSP in one or a number of web pages. We perform a large scale evaluation of the CSP policies in real-world applications. The most serious problem that we find out is that their policies only leverage a small part of security ability of CSP. Copyright © 2016 John Wiley & Sons, Ltd.

Single vessel air injection estimates of xylem resistance to cavitation are affected by vessel network characteristics and sample length.

Xylem resistance to cavitation is an important trait that is related to the ecology and survival of plant species. Vessel network characteristics, such as vessel length and connectivity, could affect the spread of emboli from gas-filled vessels to functional ones, triggering their cavitation. We hypothesized that the cavitation resistance of xylem vessels is randomly distributed throughout the vessel network. We predicted that single vessel air injection (SVAI) vulnerability curves (VCs) would thus be affected by sample length. Longer stem samples were predicted to appear more resistant than shorter samples due to the sampled path including greater numbers of vessels. We evaluated the vessel network characteristics of grapevine (Vitis vinifera L.), English oak (Quercus robur L.) and black cottonwood (Populus trichocarpa Torr. & A. Gray), and constructed SVAI VCs for 5- and 20-cm-long segments. We also constructed VCs with a standard centrifuge method and used computer modelling to estimate the curve shift expected for pathways composed of different numbers of vessels. For all three species, the SVAI VCs for 5 cm segments rose exponentially and were more vulnerable than the 20 cm segments. The 5 cm curve shapes were exponential and were consistent with centrifuge VCs. Modelling data supported the observed SVAI VC shifts, which were related to path length and vessel network characteristics. These results suggest that exponential VCs represent the most realistic curve shape for individual vessel resistance distributions for these species. At the network level, the presence of some vessels with a higher resistance to cavitation may help avoid emboli spread during tissue dehydration.

Designing vulnerability testing tools for web services: approach, components, and tools

This paper proposes a generic approach for designing vulnerability testing tools for web services, which includes the definition of the testing procedure and the tool components. Based on the proposed approach, we present the design of three innovative testing tools that implement three complementary techniques (improved penetration testing, attack signatures and interface monitoring, and runtime anomaly detection) for detecting injection vulnerabilities, thus offering an extensive support for different scenarios. A case study has been designed to demonstrate the tools for the particular case of SQL Injection vulnerabilities. The experimental evaluation demonstrates that the tools can effectively be used in different scenarios and that they outperform well-known commercial tools by achieving higher detection coverage and lower false-positive rates.

English

English

Mining trends and patterns of software vulnerabilities

Zero-day vulnerabilities continue to be a threat as they are unknown to vendors; when attacks occur, vendors have zero days to provide remedies. New techniques for the detection of zero-day vulnerabilities on software systems are being developed but they have their own limitations; e.g., anomaly detection techniques are prone to false alarms. To better protect software systems, it is also important to understand the relationship between vulnerabilities and their patterns over a period of time. The mining of trends and patterns of vulnerabilities is useful because it can help software vendors prepare solutions ahead of time for vulnerabilities that may occur in a software application. In this paper, we investigate the use of historical patterns of vulnerabilities in order to predict future vulnerabilities in software applications. In addition, we examine whether the trends of vulnerabilities in software applications have any significant meaning or not. We use the National Vulnerability Database (NVD) as the main resource of vulnerabilities in software applications. We mine vulnerabilities of the last six years from 2009 to 2014 from NVD. Our results show that sequences of the same vulnerabilities (e.g., buffer errors) may occur 150 times in a software product. Our results also depict that the number of SQL injection vulnerabilities have decreased in the last six years while cryptographic vulnerabilities have seen an important increase. However, we have not found any statistical significance in the trends of the occurrence of vulnerabilities over time. The most interesting finding is that the sequential patterns of vulnerability events follow a first order Markov property; that is, we can predict the next vulnerability by using only the previous vulnerability with a recall of approximately 80% and precision of around 90%.

JS‐SAN: defense mechanism for HTML5‐based web applications against javascript code injection vulnerabilities

AbstractThis paper presents an injection and clustering‐based sanitization framework, i.e. JS‐SAN (JavaScript SANitizer) for the mitigation of JS code injection vulnerabilities. It generates an attack vector template by performing the clustering on the extracted JS attack vector payloads corresponding to their level of similarity. As a result, it then sanitizes the extracted JS attack vector template by an automated technique of placement of sanitizers in the source code of generated templates of web applications. We have also performed the deepest possible crawling of web pages for finding the possible user‐injection points and injected the latest HTML5‐based XSS attack vectors for testing the mitigation capability of our framework. The implementation of our design was done on the browser‐side JavaScript library and tested as an extension on the Google Chrome. The attack mitigation capability of JS‐SAN was evaluated by incorporating the support from a tested suite of open source web applications that are vulnerable to JS code injection vulnerabilities. The proposed framework validates its novelty by producing a less rate of false negatives and tolerable runtime overhead as compared to existing sanitization‐based approaches. Copyright © 2016 John Wiley & Sons, Ltd.

Automated Discovery of JavaScript Code Injection Attacks in PHP Web Applications

This paper discussed some of the performance issues in the existing defensive solutions of Java Script injection attacks (e.g. Cross-Site Scripting (XSS) attacks). Moreover, a high level of comparison for such existing solutions has been done based on some useful metrics. Based on the identified performance issues, this paper proposed an automated detection system, which scans the numerous possible locations of web sites for JavaScript injection vulnerabilities. Our detection system, firstly, scans the web site for discovering the injection locations. Secondly, it injects the malicious XSS attack vectors in such injection points. Lastly, it takes an input as the list of different XSS attacks exploited in the second step and scan for these attacks in the vulnerable web application. Detection capability of our automated system is evaluated on a real world PHP web application i.e. BlogIt and results obtained are very promising.

A Protection Mechanism against Malicious HTML and JavaScript Code in Vulnerable Web Applications

The high-profile attacks of malicious HTML and JavaScript code have seen a dramatic increase in both awareness and exploitation in recent years. Unfortunately, exiting security mechanisms provide no enough protection. We propose a new protection mechanism named PMHJ based on the support of both web applications and web browsers against malicious HTML and JavaScript code in vulnerable web applications. PMHJ prevents the injection attack of HTML elements with a random attribute value and the node-split attack by an attribute with the hash value of the HTML element. PMHJ ensures the content security in web pages by verifying HTML elements, confining the insecure HTML usages which can be exploited by attackers, and disabling the JavaScript APIs which may incur injection vulnerabilities. PMHJ provides a flexible way to rein the high-risk JavaScript APIs with powerful ability according to the principle of least authority. The PMHJ policy is easy to be deployed into real-world web applications. The test results show that PMHJ has little influence on the run time and code size of web pages.

A deliberately insecure RDF-based Semantic Web application framework for teaching SPARQL/SPARUL injection attacks and defense mechanisms

The Semantic Web uses the Resource Description Framework (RDF) and the Simple Protocol and Query/Update Languages (SPARQL/SPARUL) as standardized logical data representation and manipulation models allowing machines to directly interpret data on the Web. As Semantic Web applications grow increasingly popular, new and challenging security threats emerge. Semantic query languages owing to their flexible nature introduce new vulnerabilities if secure programming practices are not followed. This makes them prone to both existing attacks such as command injection as well as novel attacks, making it necessary for application developers to understand the security risks involved when developing and deploying semantic applications. In this research, we have analyzed and categorized the possible SPARQL/SPARUL injection attacks to which semantic applications are vulnerable. Moreover, we have developed a deliberately insecure RDF-based Semantic Web application, called SemWebGoat – inspired by the open source vulnerable web application, WebGoat – which offers a realistic teaching and learning environment for exploiting SPARQL/SPARUL oriented injection vulnerabilities. With the aim of teaching both developers and web administrators the art of protecting their Semantic Web applications, we have implemented web application firewall (WAF) rules using the popular open-source firewall – ModSecurity – and extended some penetration testing tools to detect and mitigate SPARQL/SPARUL injections. For the evaluation, we conducted a user study to determine the usability of SemWebGoat attack lessons as well as a detection rate and false alarm analysis of our proposed firewall rules based on OWASP top-ten attack dataset. The results of the user study conclude that web developers are not normally familiar with the injection vulnerabilities demonstrated. The positive test results of our ModSecurity rule set show that it a suitable defense mechanism for protecting vulnerable Semantic Web application against injection attacks.

REVIEW ON SQL INJECTION PROTECTION METHODS AND TOOLS

SQL injection vulnerability is one of the most common web-based application vulnerabilities that can be exploited by SQL injection attack. Successful SQL Injection Attacks (SQLIA) result in unauthorized access and unauthorized data modification. Researchers have proposed many methods to tackle SQL injection attack, however these methods fail to address the whole problem of SQL injection attack, because most of the approaches are vulnerable in nature, cannot resist sophisticated attack or limited to scope of subset of SQLIA type. In this paper we provide a detailed background of SQLIA together with vulnerable PHP code to demonstrate how attacks are being carried out, and discuss most commonly used method by programmers to defend against SQLIA and the disadvantages of such an approach. Lastly we reviewed most commonly use tools and methods that act a firewall for preventing SQLIA, finally wean alytically evaluated reviewed tools and methods based on our experience with respect to five different perspectives. Our evaluation results point out common trends on current SQLI prevention tools and methods. Most of these methods and tools have problems addressing store-procedure attacks, as well as problems addressing attacks that take advantage of second order SQLI vulnerability. Our evaluation also shows that only a few of these methods and tools considered can be deployed in all web-based application platforms.

An Automatic Detection System for SQL Injection

The growth of the internet is increasing day by day, mostly content is database driven. There are many web applications like E-Commerce, banking where he/she has to trust on this application and have to provide personal information into their underlying database. If there is no confidentiality and security of information then any one can steal or see our information or may utilize this information for misbehaving activity. One of them is SQL injection, a hacker may insert his bad/malicious SQL code into other’s database and running of those queries is capable to extract private and valuable information or may destroy the database. In this paper, proposing a technique to detect SQL injection using the hidden web crawling technique incorporating with parse tree and digital signature. The proposed scheme finds a SQL injection vulnerability by replicating web attack and analyze the data of the response. The proposed technique is compared with hidden web crawling technique to analyze its’s effectiveness. For experimental evaluation, implement this system in Eclipse with MYSQL database to analyze the results.