SQL Injection & Web Methodologies Development & Evolution

     This article is about how different groups of scientists and researchers discovered methods and techniques to analyze web and prevent web from the sql injection attacks. Different tools and tactics used by them are also mentioned in this article.

·         Salas et.al. use WSInject as a tool to analyse web services. A general purpose fault injection tool that unlike other security testing tools can make various scenarios of different types of attacks. Thus they were able to compare it with results of a vulnerability scanner soapUI. They also concluded that soapUI was less efficient as compared to WSInject. XSS attack was performed with WSInject tool and then they created different attack scenarios and emulated attacks with this tool. The analysis was documented and verified using WSInject technology. A number of vulnerabilities were reduced by the security and made it possible to build a number of variations to new type of XSS attacks.

·         Fabien et. al. presented a methodology in which by generating test inputs using a combination of model inference and evolutionary fuzzing one can detect web injection vulnerabilities. Knowledge of application behaviour is obtained by Model Inference. Inputs are generated using GA i.e. Genetic Algorithm, uses the formal model to automatically generate inputs with better fitness values towards triggering an instance of the given vulnerability. An automated XSS search technique was proposed which is based on model inference and evolutionary fuzzing to generate test cases.

·         Yu sun et.al. for defence against cross site scripting attacks proposed a model checking method. Bugs present in the e-commerce website were found and counter examples were shown by model checking. Proposed an automatic modelling algorithm for the HTML code and presented the case of performance of the algorithm.

·         Indrani Balasundaram et.al. presented an authentication scheme using hybrid encryption. Hybrid because the algorithm uses both Advance Encryption Standard (AES) and Rivest-Shamir-Adleman(RSA) to prevent SQL injection attacks. Two level of encryption is applied on login query in this method. A unique secret key is issued to every user and server uses combination of private key and public key for Rivest-Shamir-Adleman  (RSA) encryption. Asymmetric key encryption via server’s public key is used to encrypt the query. Symmetric key encryption via user’s secret key is used to encrypt user name and password.

·         Allen Pomeroy et.al. used network recording to reconstruct SQL Injection attack effectively. In order to find vulnerabilities in web applications the authors suggested this technique of network recording. To analyse the network packets containing get and post requests of a web application network forensic techniques and tools were used. This approach to trigger network recording of suspected application attack uses network based Intrusion Detection System (IDS).

·         Bisht et. al. to prevent SQL injection proposed a dynamic candidate evaluation approach. Candidate evaluation for Discovering Intent Dynamically(CANDID), a tool proposed by authors is used to record the programmer-intended SQL query structure on any input(candidate input) from the legitimate user. It is then compared with the query structure generated with the attackers input.

·         Michelle Ruse et.al. proposed an approach to detect SQL Injection Vulnerabilities by using automatic test case generation. This framework is built upon the idea of creating a model that deals with SQL queries automatically and captures dependencies among various components of the query. It identifies the conditions in which the queries are vulnerable and uses CREST(Automatic Test Generation Tool for C) test generator. The results show that this method is able to identify the causal set and obtain 85% and 69% reduction respectively while experimenting on few test cases.

·         Xin Wang et.al. based upon access authorization data table (AADT) proposed a hidden web crawling technology. By recording authorization information through cookies, session etc. the web crawlers can be used to gain pages behind login forms. To enhance the ability of web scanner and to raise the web page coverage of crawler model study of web vulnerability detection mechanisms is done. Each and every hidden hyperlink and form present in pages is crawled by crawlers to improve overall web page detection ability of web scanner.

·         Ezumalai et.al. proposed a signature based SQL injection detection technique. SQL queries in web applications is divided smaller units called tokens which is sent for validation. Hirschberg's algorithm which is a divide and conquer version of the Needleman-Wunsch algorithm, is used to detect SQL injection attacks to validate these tokens. No runtime changes are required as it is defined at application level.

·         Avancini et.al. proposed a method of scanning web applications for testing their security. They detected application’s cross-site scripting vulnerabilities by exploiting static analysis. Through a genetic algorithm they looked at input values which uncover these vulnerabilities. To help the genetic algorithm escape local optima, symbolic constraints are gathered at run-time and go to a solver. Software developer’s index search results test cases to comprehend and settle security issues. This approach was implemented in a model and evaluated on world PHP code. They changed conditions identified by static analysis into structural constraints in this paper.

·         Rattipong et. al. presented a methodology for protecting cookies from Cross Site Script attack. This method changes cookies in such a way that they become useless for XSS attacks. Dynamic Cookie Rewriting, is a technique implemented in a web intermediary where cookies are automatically removed with randomized value before sending the cookie to the system browser. Through this way, instead of keeping the unique value sent by the web browser, the system browser will keep the randomized value. This procedure is only tested on HTTP connections.

·         Adam et.al. created an automatic system which exposes SQLI and XSS vulnerabilities through generating input test cases. In this technique, test inputs are created and changed to deliver concrete exploits and track corrupts through execution. The technique addresses second order XSS attack, it makes genuine attack vectors, works without requiring modification of application code, and handles dynamic programming constructs. This technique was executed for PHP by tool named, Ardilla, which can make input for one PHP script at once but it cannot simulate sessions ( i.e. applications which involve multiple pages user-interaction), even if the input generator makes an input that achieves sink, Ardilla cannot produce attacks for sink.

·         Mike et.al. proposed an XSS defence methodology, in spite of behaviour anomalous browser it was intended to be effective in existing browser systems. The proposed approach minimizes trust placed on system browser for interpreting untrusted content. BLUEPRINGT is a tool used to implement this approach and it was integrated with a few popular web applications. It was a strong way to prevent cross-site scripting attacks which was effective upon 96% of the system browser.

·         Wassermann et. al. presented a static analysis which specifically addresses weak or missing input validation for discovering cross-site scripting vulnerabilities. This approach combines data obtained through corrupted information flow with string analysis. Due to the numerous ways to invoke the Java interpreter input validation is troublesome. This approach confront a similar obstacle to statistically check for vulnerabilities. This is addressed by formalizing a policy based upon W3C suggestion, the Firefox source code, and online activities about closed source web browsers. An approach to find XSS vulnerabilities due to unchecked untrusted information and  insufficiently-checked entrusted data is proposed in this paper. The approach has two parts - an adjusted string analysis to track entrusted substring values and a check for endowed scripts in view of formal language methods.

·         Shanmugam, et. al. proposed an approach to detect behaviour based anomaly which presents a security layer on top of the websites, due to which whenever new threats appears the mechanisms are changed but the current websites stay unmodified. Also, to reduce processing time application parameters are acquainted, this approach gives security to websites by permitting tags to be entered in the websites. To decrease processing time it uses whitelist security model due to which it is not prone to zero-day attacks.