Publication Type

Conference Proceeding Article

Version

acceptedVersion

Publication Date

12-2012

Abstract

Recent reports reveal that majority of the attacks to Web applications are input manipulation attacks. Among these attacks, SQL injection attack malicious input is submitted to manipulate the database in a way that was unintended by the applications' developers is one such attack. This paper proposes an approach for assisting to code verification process on the defense against SQL injection. The approach extracts all such defenses implemented in code. With the use of the proposed approach, developers, testers or auditors can then check the defenses extracted from code to verify their adequacy. We have evaluated the feasibility, effectiveness, and usefulness of the proposed approach by a set of open-source systems. Our experiment results showed that the proposed approach is effective in extracting all the possible defenses implemented/adopted by Web applications. We observed that the proposed approach would be useful in identifying the false positive cases resulting from other related approaches and auditing the code in order to fix the actual vulnerable cases.

Keywords

SQL injection, vulnerabilities, code auditing, software security, static analysis, Web applications

Discipline

Information Security | Software Engineering

Research Areas

Software and Cyber-Physical Systems

Publication

2012 19th Asia-Pacific Software Engineering Conference (APSEC): Hong Kong, December 4-7: Proceedings

First Page

91

Last Page

96

ISBN

9780769549224

Identifier

10.1109/APSEC.2012.18

Publisher

IEEE Computer Society

City or Country

Los Alamitos, CA

Copyright Owner and License

Authors

Additional URL

https://doi.org/10.1109/APSEC.2012.18

Download

Share

COinS