Other (Reports)
Black-box SQL Injection Testing
Appelt, Dennis; Alshahwan, Nadia; Nguyen, Duy Cu et al.
2014
 

Files


Full Text
TR-SnT-2014-1.pdf
Publisher postprint (490.35 kB)
Download

All documents in ORBilu are protected by a user license.

Send to



Details



Keywords :
Mutation Testing; Security Testing; Test Generation
Abstract :
[en] Web services are increasingly adopted in various domains, from finance and e-government to social media. As they are built on top of the web technologies, they suffer also an unprecedented amount of attacks and exploitations like the Web. Among the attacks, those that target SQL injection vulnerabilities have consistently been top-ranked for the last years. Testing to detect such vulnerabilities before making web services public is crucial. We present in this report an automated testing approach, namely μ4SQLi, and its underpinning set of mutation operators. μ4SQLi can produce effective inputs that lead to executable and harmful SQL statements. Executability is key as otherwise no injection vulnerability can be exploited. Our evaluation demonstrated that the approach outperforms contemporary known attacks in terms of vulnerability detection and the ability to get through an application firewall, which is a popular configuration in real world.
Research center :
Interdisciplinary Centre for Security, Reliability and Trust
Disciplines :
Computer science
Author, co-author :
Appelt, Dennis ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Alshahwan, Nadia ;  University College London > Department of Computer Science
Nguyen, Duy Cu ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Briand, Lionel ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) ; University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)
Language :
English
Title :
Black-box SQL Injection Testing
Publication date :
28 January 2014
ISBN/EAN :
978-2-87971-121-8
Report number :
TR-SnT-2014-1
Funders :
FNR - Fonds National de la Recherche [LU]
Available on ORBilu :
since 20 January 2014

Statistics


Number of views
712 (59 by Unilu)
Number of downloads
786 (24 by Unilu)

Bibliography


Similar publications



Contact ORBilu