Reference : Automated Testing for SQL Injection Vulnerabilities: An Input Mutation Approach
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
http://hdl.handle.net/10993/16407
Automated Testing for SQL Injection Vulnerabilities: An Input Mutation Approach
English
Appelt, Dennis mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)]
Nguyen, Duy Cu mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Briand, Lionel mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > > ; University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)]
Alshahwan, Nadia mailto [University College London - UCL > Department of Computer Science]
21-Jul-2014
Proc. of the International Symposium on Software Testing and Analysis 2014
Yes
International
International Symposium on Software Testing and Analysis
July 21-25
San Jose, CA
USA
[en] Mutation testing ; SQL Injection ; Test Generation
[en] Web services are increasingly adopted in various domains, from finance and e-government to social media. As they are built on top of the web technologies, they suffer also an unprecedented amount of attacks and exploitations like the Web. Among the attacks, those that target SQL injection vulnerabilities have consistently been top-ranked for the last years. Testing to detect such vulnerabilities before making web services public is crucial. We present in this paper an automated testing approach, namely μ4SQLi, and its underpinning set of mutation operators. μ4SQLi can produce effective inputs that lead to executable and harmful SQL statements. Executability is key as otherwise no injection vulnerability can be exploited. Our evaluation demonstrated that the approach is effective to detect SQL injection vulnerabilities and to produce inputs that bypass application firewalls, which is a common configuration in real world.
Researchers ; Professionals ; Students
http://hdl.handle.net/10993/16407

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Limited access
main.pdfPublisher postprint472.04 kBRequest a copy

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.