Abstract
According to OWASP top10 Application Security Risks [8, 9] SQL injection (SQLi) remains the most dangerous and most commonly exploited vulnerability in web applications. Thus, a lot of attentions are devoted by the scientific community for the development of SQLi verification tools. In this paper we focus on the development of an efficient, black box, SQLi vulnerability scanner to achieve an accurate detection. Our new approach is based on the use of structural similarity between rejection pages and their corresponding injection pages. A software prototype has been implemented and showed promising results as compared to well-known web application scanners.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Acunetix: Acunetix scanner. https://www.acunetix.com/vulnerability-scanner. Accessed 21 June 2019
Acunetix-acuart: testphp. http://testphp.vulnweb.com. Accessed 21 June 2019
Aliero, M.S., Ghani, I., Qureshi, K.N., Rohani, M.F.: An algorithm for detecting SQL injection vulnerability using black-box testing. J. Ambient Intell. Humaniz. Comput. 11(1), 249–266 (2019). https://doi.org/10.1007/s12652-019-01235-z
Djuric, Z.: A black-box testing tool for detecting SQL injection vulnerabilities. In: Second International Conference on Informatics Applications (ICIA), pp. 216–221, September 2013. https://doi.org/10.1109/ICoIA.2013.6650259
GitHub: SQLi scanner. https://github.com/lalia-dz/SQLiScanner. Accessed 22 Oct 2019
GitHub: XVWA. https://github.com/s4n7h0/xvwa. Accessed 26 Oct 2019
HackThisSite. https://www.hackthissite.org/missions/realistic. Accessed 21 June 2019
OWASP: OWASP\_Top10\_2017. https://www.owasp.org/index.php/Top_10-2017_Top_10. Accessed 21 June 2019
OWASP: Top\_10\_2013. https://www.owasp.org/index.php/Top_10_2013-Top_10. Accessed 21 June 2019
OWASP: ZAP scanner. https://www.zaproxy.org
W3af: w3af framework. http://w3af.org. Accessed 21 June 2019
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Saoudi, L., Adi, K., Boudraa, Y. (2020). A Rejection-Based Approach for Detecting SQL Injection Vulnerabilities in Web Applications. In: Benzekri, A., Barbeau, M., Gong, G., Laborde, R., Garcia-Alfaro, J. (eds) Foundations and Practice of Security. FPS 2019. Lecture Notes in Computer Science(), vol 12056. Springer, Cham. https://doi.org/10.1007/978-3-030-45371-8_26
Download citation
DOI: https://doi.org/10.1007/978-3-030-45371-8_26
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-45370-1
Online ISBN: 978-3-030-45371-8
eBook Packages: Computer ScienceComputer Science (R0)