Neutralizing SQL Injection Attack Using Server Side Code Modification in Web Applications

Dalai, Asish Kumar; Jena, Sanjay Kumar

doi:10.1155/2017/3825373

Cited by 20 publications

(13 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…According to [6] there are different types of SQL injection attack as presented in many studies. These attack types have been named based on the technique implemented to exploit the injection vulnerability as listed below:…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Neutralizing SQL Injection Attack on Web Application Using Server Side Code Modification

Sarjiyus

El-Yakub

2019

IJSRCSEIT

View full text Add to dashboard Cite

SQL Injection attacks pose a very serious security threat to Web applications and web servers. They allow attackers to obtain unrestricted access to the databases underlying the applications and to the potentially sensitive and important information these databases contain. This research, “Neutralizing SQL Injection attack on web application using server side code modification” proposes a method for boosting web security by detecting SQL Injection attacks on web applications by modification on the server code so as to minimize vulnerability and mitigate fraudulent and malicious activities. This method has been implemented on a simple website with a database to register users with an admin that has control privileges. The server used is a local server and the server code was written with PHP as the back end. The front end was designed using MySQL. PHP server side scripting language was used to modify codes. ‘PDO prepare’ a tool to prepare parameters to be executed. The proposed method proved to be efficient in the context of its ability to prevent all types of SQL injection attacks. Acunetix was used to test the vulnerability of the code, and the code was implemented on a simple website with a simple database. Some popular SQL injection attack tools and web application security datasets have been used to validate the model. Unlike most approaches, the proposed method is quite simple to implement yet highly effective. The results obtained are promising with a high accuracy rate for detection of SQL injection attack.

show abstract

Section: Methodsmentioning

confidence: 99%

“…Most of the time, the query that is passed to the database server for execution contains user-supplied parameters. The input parameters provided by the user may or may not be trustworthy [6]. It is obvious that the query processor will execute the query and return the result to the user without considering about its type.…”

mentioning

confidence: 99%

Neutralizing SQL Injection Attack on Web Application Using Server Side Code Modification

Sarjiyus

El-Yakub

2019

IJSRCSEIT

View full text Add to dashboard Cite

show abstract

“…Seperti yang telah dilakukan oleh peneliti sebelumnya guna mengatasi permasalahan serangan ini. Seperti halnya yang telah dilakukan oleh Asish Kumar Dalai, dkk (2017), menggunakan metode server side code modification untuk mencegah serangan SQL injection [10]. Metode ini bekerja dengan cara memblokir query inputan jika berdasarkan perbandingan dengan query asli menimbulkan hasil yang berbeda.…”

Section: Pendahuluanunclassified

Implementasi Web Application Firewall Dalam Mencegah Serangan SQL Injection Pada Website

Bangkit

Prabowo²,

Ananda³

2020

Digitalzone

View full text Add to dashboard Cite

Dalam beberapa tahun terakhir perkembangan teknologi informasi menjadi semakin pesat, perkembangan ini membuat segala aktifitas dan pekerjaan menjadi lebih mudah, seperti halnya untuk mengakses berita maupun informasi. Salah satu media yang sering digunakan untuk menemukan berbagai macam informasi pada saat ini yaitu website. Banyaknya website yang ada pada saat ini membuat ia sering dijadikan sasaran berbagai jenis serangan web yang beragam seperti SQL injection. Sehingga diperlukan suatu sistem yang mampu memberikan solusi dalam pengamanan website. Pada penelitian ini menggunakan metode web application firewall karena metode ini mampu untuk menjadi security system dalam mengamankan suatu website dari serangan. Metode web application firewall dilakukan dengan memblokir serangan sql injection yang masuk berdasarkan konfigurasi rules yang telah ditetapkan. Dan dari hasil penelitian ini serangan SQL injection yang telah diujicobakan pada website berhasil diblokir sehingga membuat website menjadi aman dari serangan tersebut.. Kata kunci: Keamanan, Serangan Web, SQL injection, Website, Web Application Firewall. Abstract In the last few years the development of information technology has become increasingly rapid, this has made all activities and jobs easier, such as accessing news and information. One of the media that is often used to find various kinds of information at this time is the website. The large number of websites that exist today makes it a frequent target of various types of web attacks such as SQL injection. So we need a system that is able to provide solutions in securing a website. This research uses a web firewall application method because this method is able to become a security system on a website from attacks. The firewall web application method is carried out by the sql injection attack method which is entered based on predefined rules. And from the results of this study, the SQL injection attack that was tested on the website was successful so that it made the website safe from these attacks. Keywords: Security, Web Attack, SQL injection, Website, Web Application Firewall

show abstract

“…Then, a logical framework was introduced [12] to evaluate the complex subqueries using SQL. But here also the performance did not improve while processing the complex subqueries in distributed environments.…”

Section: Related Workmentioning

confidence: 99%

BIBSQLQC: Brown infomax boosted SQL query clustering algorithm to detect anti-patterns in the query log

Ramakrishnan¹,

Palanisamy²

2020

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

Discovery of antipatterns from arbitrary SQL query log depends on the static code analysis used to enhance the quality and performance of software applications. The existence of antipatterns reduces the quality and leads to redundant SQL statements. SQL log includes a large load on the database and it is difficult for an analyst to extract large patterns in a minimal time. Existing techniques which discover antipatterns in SQL query face a lot of innumerable challenges to discover the normal sequences of queries within the log. In order to discover the antipatterns in the log, an efficient technique called Brown infomax boosted SQL query clustering (BIBSQLQC) technique is introduced. Initially, the number of patterns (i.e. queries) are extracted from the SQL query log. After extracting the patterns, the ensemble clustering process is carried out to find out the antipatterns from the given query log. The Brown infomax boost clustering is an ensemble learning method for grouping the patterns by constructing several weak learners. The Brown clustering is used as a weak learner for partitioning the patterns into 'k' number of clusters based on the Euclidean distance measure. Then the weak learner merges the two clusters with maximum information gained to minimize the time complexity. The clustering results of weak learners are combined into strong results with minimal error rate (ER). By this way, the antipattern in the SQL query log is detected with a higher accuracy. Experimental evaluation is conducted with different parameters namely detection accuracy (DA), false positive rate (FPR) and time complexity (TC) using the two SQL query log data-sets (DS). The experimental result shows that, the BIBSQLQC technique achieves higher DA with lower TC and FPR than the conventional methods.

show abstract

Neutralizing SQL Injection Attack Using Server Side Code Modification in Web Applications

Cited by 20 publications

References 26 publications

Neutralizing SQL Injection Attack on Web Application Using Server Side Code Modification

Neutralizing SQL Injection Attack on Web Application Using Server Side Code Modification

Implementasi Web Application Firewall Dalam Mencegah Serangan SQL Injection Pada Website

BIBSQLQC: Brown infomax boosted SQL query clustering algorithm to detect anti-patterns in the query log

Contact Info

Product

Resources

About