SQL Injection Attacks Research Articles

Security Performance Analysis of Photography Service System

Photography business become more popular and trending among the most of people who likes photography. Photography Service System was developed to help photography companies to deliver photos and videos to their customers. The use of the system have its advantages such as easiness of accessing data and also make users share the data faster. The purpose of the system was developed to ease the daily works and can be used frequently by photography companies as a method to send photos and videos to their customers. A penetration testing was conducted in order to test the security performance by conducting four security attacks which were Denial of Service (DoS), SQL injection, Cross Site Scripting, and sniffing password. The purpose of these attacks were conducted is to testing and finding the vulnerabilities of the system because the system deals with the customers’ privacy data which is the photos and the videos owned by the customers. This is crucial to secure a system where the first step taken as a prevention to introduce the system to the public, vulnerability assessments was performed to determine the weaknesses of the system. Scanning and vulnerability assessment are done using tools which is Vega Scanning Tool, Wireshark, and Low Orbit Ion Cannon (LOIC). All results are collected and have been analyze. As a summary of the result, it shows that the system are vulnerable to DoS attack, SQL injection attack, cross site scripting and also password sniffing.

Detection of SQL Injection Attacks Based on Improved TFIDF Algorithm

Detecting SQL injection attacks (SQLIAs) effectively is one of the critical issues to be solved in Web secure fields. Aiming at the problem that the distribution of feature words in the same kind of statements is not considered when using TFIDF algorithm to vectorize the text of SQL statements, a method of detecting SQLIAs based on improved Term Frequency-Inverse Document Frequency (TFIDF) algorithm is proposed. Firstly, TFIDF algorithm is improved based on the distribution of feature words in the same kind of statements. Then, the improved TFIDF (ITFIDF) algorithm is used to vectorize the dataset of SQL statements to increase the feature weight of the SQL statement. Finally, the detection of SQLIAs is carried out based on Support Vector Machine (SVM). The experimental results show that the combination of SVM and ITFIDF has higher accuracy, recall rate and F-score compared with other similar methods. At the same time, the experimental results also show that SVM has better classification performance when dealing with this problem than other machine learning models such as DNN and Decision Tree.

Secure Online Election System

India, the biggest democratic ruling system in terms of population utilises the Electronic Voting Machine or EVM for their general elections. Any EVM comprises of two units: The Control unit and the Ballot unit. O n g o i n g re s e a rc h h a s i n d i c a t e d m a n y disadvantages in the system. One of the main disadvantages we encounter is that many researchers have claimed that the EVM can easily be tampered with. EVMs also encounter many physical threats. To prevent these drawbacks, we have proposed an online voting s y s t e m w h i c h c o u n t e r m a n y p h y s i c a l difficulties faced by the EVM. One main difficulty in the online system is the SQL Injection attack. SQL injection is messing with the database and controlling it with the help of SQL Queries. Our project focuses on the Tautology based SQL Injection attack. In this attack, a statement whose value will always be true or 1 is passed instead of username and password by the hacker. This allows access to t h e d a t a b a s e w h i c h a l l o w s h i m / h e r t o manipulate it. Manipulation can be of several kinds. Web based Voting is another innovation that is rising which has the possibility of countering numerous downsides looked by the EVMs. The online voting application works as any other web application. Each voter who wants to vote needs to fill all the required details and create an account on the website first. On the day of voting, when voters cast their vote, they need to sign in with their respective credentials. When the credentials match with the data from database, the voter can get to the voting page and make his choice. An affirmation mail is the sent to the client after effectively making the choice. The votes cast by the voters are sent to a separate database which is viewed in the administration s i d e . We u s e s t o r e d p r o c e d u r e s a n d parameterized queries to prevent the Tautology based SQL attack. If a malicious user enters any query which has a value, it will simply be passed as a parameter to the SQL statement and wont be a component of the SQL statement itself, thus rendering the stored procedure invulnerable to SQL injection attacks. We also use the Secure Hash Algorithm 256 (SHA-256). It is a type of cryptographic hash function which generates a unique 256 bit long hash key for each vote. It is a one way function and so it cannot be decrypted. This ensures that the votes are not manipulated.

Research on Countermeasure of SQL Injection Attack

At present, it is indispensable to utilize data as an information society. Therefore, the database is used to manage large amounts of data. In real life, most of the data in a database is the personal information of a group of members. Because personal information is sensitive data, the role of the database administrator who manages personal information is important. However, there is a growing number of attacks on databases to use this personal information in a malicious way. SQL Injection is one of the most known and old hacking techniques. SQL Injection attacks are known as an easy technique, but countermeasures are easy, but a lot of efforts are made to avoid SQL attacks on web pages that require a lot of logins, but some sites are still vulnerable to SQL attacks. Therefore, this study suggests effective defense measures through analysis of SQL hacking technology cases and contributes to preventing web hacking and providing a secure information communication environment.

Component Based Web Application Firewall for Analyzing and Defending SQL Injection Attack Vectors

Structured query language injection is a top rated vulnerability by open web application security project community. If a web application has structured query language vulnerability in source code, then such application is prone to cyber-attacks, leading to attack on confidentiality, integrity and availability. Attackers are always ready to exploit structured query language injection vulnerabilities by executing various online attack vectors and many times successfully bypass authentication and authorization to gain privilege access on web and database server leading to service interruption, data interception, modification, fabrication and sometime complete deletion of database. The present paper is an attempt to propose an advance component based web application firewall to enhance web application security by mitigating structured query language injection attack vectors by analyzing hypertext transfer protocol request variables through analyzer component and defending injection attack through defender component based on content policy installed on advance web application firewall.

DIAVA: A Traffic-Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data

SQL injection attack (SQLIA) is among the most common security threats to web-based services that are deployed on cloud. By exploiting web software vulnerabilities, SQL injection attackers can run arbitrary malicious code on target databases to acquire or compromise sensitive data. Although web application firewalls (WAFs) are offered by most cloud service providers, tenants are reluctant to pay for them, since there are few approaches that can report accurate SQLIA statistics for their deployed services. Traditional WAFs focus on blocking suspicious SQL requests. Few of them can accurately decide whether an attack is really harmful and quickly answer how severe the attack is. To raise the tenants’ awareness of the seriousness of SQLIAs, in this paper, we introduce a novel traffic-based SQLIA detection and vulnerability analysis framework named DIAVA, which can proactively send warnings to tenants promptly. By analyzing the bidirectional network traffic of SQL operations and applying our proposed multilevel regular expression model, DIAVA can accurately identify successful SQLIAs among all the suspects. Meanwhile, the severity of such SQLIAs and the vulnerabilities of the corresponding leaked data can be quickly evaluated by DIAVA based on its GPU-based dictionary attack analysis engine. Experimental results show that DIAVA not only outperforms state-of-the-art WAFs in detecting SQLAs from the perspectives of precision and recall, but also enables real-time vulnerability evaluation of leaked data caused by SQL injection.

Security Defense Strategy for Intelligent Medical Diagnosis Systems (IMDS).

The Intelligence Medical Diagnosis System (IMDS) has been targeted by the cyber terrorists, who aim to destroy the Critical National Infrastructure (CNI). This paper is motivated by the most recent incidents happened worldwide and have resulted in the compromise of diagnosis results. This study was undertaken to show how the IMDS could be attacked and diagnosis results compromised and present a set of cyber defense strategies to prevent against such attacks. This study used the ECGs data from the PhysioNet/Computing in Cardiology (CinC) Challenge 2017. We fed the data into our IMDS and launched a series of ethical hacking, which is specifically tailored to target IMDS. We proposed a set of cyber security strategies to prevent such compromise. We tested the effectiveness of our cyber defense strategies using an experiment. The results showed that the strategies were effective in protecting the IMDS diagnosis results from being compromised. This study provides novel insights into the protection of IMDS and concludes that our cyber defense strategies can protect IMDS from being compromised by Brute Force and SQL Injection attacks.

Cross Site Scripting (XSS) and SQL-Injection Attack Detection in Web Application

Now a days new web application tools generated day by day so the security of web is most important. From the few years back the web attacks was increasing so it is a big problem. But now various scanner vulnerability tools are available so we can find out the attack if it is any in the web application if we aware the attack then able to find the solution of the problem and protect them from the attackers. With the help of tools we can find the type of vulnerability is occur mostly SQL-injection attack and cross site scripting attacks are possible in the web application.

RETRACTED: A quantitative risk analysis methodology for the security of web application database against SQL injection (SQLi) attacks utilizing fuzzy logic system as computational technique

For all intents and purposes, web applications with a basic database are feeble on the way for SQLi (Structure Query Language injection) attacks. Privately owned businesses progressively depend on ...

A Survey on SQL Injection Prevention Methods

Database plays a very important role in everyone’s life including the organizations since everything today is connected via Internet and to manage so many data. There is a need of database which helps organizations to organize, sort and manage the data and to ensure that the data which a user is receiving and sending through the mean of database is secure since the database stores almost everything such as Banking details which includes user id, Password and so. Thus, it means that the data are really valuable and confidential to us and therefore security really matters for database. SQL Injection Attacks on the database are becoming common in this era where the hackers are trying to steal the valuable data of an individual through the mean of SQL Injection Attack by using malicious query on the application. This application reveals the individual data by an efficient and the best SQL Injection Prevention technique is required in order to protect the individual data from being stolen by the hackers. Therefore, this paper will be focusing on reviewing different types of SQL Injection prevention methods and SQL injection types. The initial finding of this paper can make comparison of different types of SQL Injection Prevention methods which will enable the Database Administrator to choose the best and the efficient SQL Injection Prevention Method for their organization. Consequently, Preventing of SQL Injection Attack from happening which would ultimately result in no data loss of an user.

Neutralizing SQL Injection Attack on Web Application Using Server Side Code Modification

SQL Injection attacks pose a very serious security threat to Web applications and web servers. They allow attackers to obtain unrestricted access to the databases underlying the applications and to the potentially sensitive and important information these databases contain. This research, “Neutralizing SQL Injection attack on web application using server side code modification” proposes a method for boosting web security by detecting SQL Injection attacks on web applications by modification on the server code so as to minimize vulnerability and mitigate fraudulent and malicious activities. This method has been implemented on a simple website with a database to register users with an admin that has control privileges. The server used is a local server and the server code was written with PHP as the back end. The front end was designed using MySQL. PHP server side scripting language was used to modify codes. ‘PDO prepare’ a tool to prepare parameters to be executed. The proposed method proved to be efficient in the context of its ability to prevent all types of SQL injection attacks. Acunetix was used to test the vulnerability of the code, and the code was implemented on a simple website with a simple database. Some popular SQL injection attack tools and web application security datasets have been used to validate the model. Unlike most approaches, the proposed method is quite simple to implement yet highly effective. The results obtained are promising with a high accuracy rate for detection of SQL injection attack.

Prevention of SQL Injection Attack by Checking the given Input Strings

Prevention of SQL Injection Attack by Checking the given Input Strings

Security vulnerabilities related to web-based data

In this digital era, organizations and industries are moving towards replacing websites with web applications for many obvious reasons. With this transition towards web-based applications, organizations and industries find themselves surrounded by several threats and vulnerabilities. One of the largest concerns is keeping their infrastructure safe from attacks and misuse. Web security entails applying a set of procedures and practices, by applying several security principles at various layers to protect web servers, web users, and their surrounding environment. In this paper, we will discuss several attacks that may affect web-based applications namely: SQL injection attacks, cookie poisoning, cross-site scripting, and buffer overflow. Additionally, we will discuss detection and prevention methods from such attacks.

Proposed Methods for Prevention of SQL Injection Attacks

Proposed Methods for Prevention of SQL Injection Attacks

A Review on Methods for Prevention of SQL Injection Attack

Web applications generally interact with backend information to retrieve persistent data and then present the information to the user as dynamically generated output, like HTML websites. This communication is commonly done through a low–level API by dynamically constructing query strings within a general-purpose programming language. SQL Injection Attack (SQLIA) is one of the very serious threats to web applications. This paper is a review on preventing technique for a SQL injection attack which can secure web applications against SQLimplantation. This paper also demonstrates a technique for preventing SQL Injection Attack (SQLIA) using Aho–Corasick pattern matching algorithm

Anomaly-Based Method for Detecting Multiple Classes of Network Attacks

The article discusses the problem of detecting network attacks on a web server. The attention is focused on two common types of attacks: “denial of service” and “code injection”. A review and an analysis of various attack detection techniques are conducted. A new lightweight approach to detect attacks as anomalies is proposed. It is based on recognition of the dynamic response of the web server during requests processing. An autoencoder is implemented for dynamic response anomaly recognition. A case study with the MyBB web server is described. Several flood attacks and SQL injection attack are modeled and successfully detected by the proposed method. The efficiency of the detection algorithm is evaluated, and the advantages and disadvantages of the proposed approach are analyzed.

LsSQLIDP : Literature survey on SQL injection detection and prevention techniques

Every smallest service on the internet is made available through web applications. Services like online shopping, online banking system, e-booking system for railways or airlines and many more are all available at your doorstep with the help of internet. With these numerous applications comes the bulk amount of data they store on daily basis in their backend databases. The issue is how to store the data in an efficient and secure manner so that it should not be misused. Nowadays most of the applications use Cloud storage for this purpose. But is the data really secured on Cloud? With the increasing cases of cyber attacks one can figure out the answer to this question. The attacks like code injection attacks, denial of service attack, spoofing, phishing attack, http flood attack et al. are some of the major attacks challenging the protection of these applications. One of the major harmful attacks is SQL injection attacks (SQLinAs). There are several detection and prevention techniques for the same yet the applications are highly vulnerable to SQLinAs. To better understand the attack, all the existing types, detection and prevention techniques for SQLinAs are analyzed and showcased in this paper.

An algorithm for detecting SQL injection vulnerability using black-box testing

SQL Injection Attack (SQLIA) is one of the most severe attack that can be used against web database-driven applications. Attackers use SQLIA to obtain unauthorized access and perform unauthorized data modifications due to initial improper input validation by the web application developer. Various studies have shown that, on average, 64% of web applications worldwide are vulnerable to SQLIA due to improper input. To mitigate the devastating problem of SQLIA, this research proposes an automatic black box testing for SQL Injection Vulnerability (SQLIV). This acts to automate an SQLIV assessment in SQLIA. In addition, recent studies have shown that there is a need for improving the effectiveness of existing SQLIVS in order to reduce the cost of manual inspection of vulnerabilities and the risk of being attacked due to inaccurate false negative and false positive results. This research focuses on improving the effectiveness of SQLIVS by proposing an object-oriented approach in its development in order to help and minimize the incidence of false positive and false negative results, as well as to provide room for improving a proposed scanner by potential researchers. To test and validate the accuracy of research work, three vulnerable web applications were developed. Each possesses a different type of vulnerabilities and an experimental evaluation was used to validate the proposed scanner. In addition, an analytical evaluation is used to compare the proposed scanner with the existing academic scanners. The result of the experimental analysis shows significant improvement by achieving high accuracy compared to existing studies. Similarly, the analytical evaluations showed that the proposed scanner is capable of analyzing attacked page response using four different techniques.

Preventing SQL Injection Attacks by Automatic Parameterizing Raw Queries Using Lexical and Semantic Analysis Methods

SQL injection (SQLI) is one of the most important security threats against web applications. Many tech-niques have been proposed for counteracting SQLI attacks; however, second-order attacks and the injectionattacks that are raising data-type mismatch errors have been ignored in most of them. In this paper, wepropose a new anomaly-based method (deploying as a proxy between the application server and its databaseserver) for detection and/or prevention of SQLI attacks without requiring any modi cation to the sourcecode of vulnerable applications. The majority of attacks, which lead to a change in the syntax of applica-tion queries, are identi ed in the detection phase by lexical analysis of the queries. The remained types ofattacks, such as second-order attacks and attacks generating data type mismatch errors, are prevented tobe executed in the prevention phase, where each query is automatically converted to a parameterized query(before submitting to its database) using a semantic analysis method.

LSTM-based SQL Injection Detection Method for Intelligent Transportation System

Intelligent transportation is an emerging technology that integrates advanced sensors, network communication, data processing, and automatic control technologies to provide great convenience for our daily lives. With the increasing popularity of intelligent transportation, its security issues have also attracted much attention. SQL injection attack is one of the most common attacks in the intelligent transportation system. It has characteristics of various types, fast mutations, hidden attacks, etc., and leads to great harm. Most of the current SQL detection methods are based on manually defined features. The detection results are heavily dependent on the accuracy of feature extraction, so it cannot cope with the increasingly complex SQL injection attacks in the intelligent transportation system. In order to solve this problem, this paper proposes a long short-term memory based SQL injection attack detection method, which can automatically learn the effective representation of data, and has a strong advantage to confront with complex high-dimensional massive data. In addition, this paper proposes an injection sample generation method based on data transmission channel from the perspective of penetration. This method can formally model SQL injection attack and generate valid positive samples. It can effectively solve the over-fitting problem caused by insufficient positive samples. The experimental results show that the proposed method improves the accuracy of the SQL injection attack detection and reduces the false positive rate, which is better than several related classical machine learning algorithms and commonly used deep learning algorithms.