Static analysis approaches to detect SQL injection and cross site scripting vulnerabilities in web applications: A survey

Abstract

Dependence on web applications is increasing very rapidly in recent time for social communications, health problem, financial transaction and many other purposes. Unfortunately, presence of security weaknesses in web applications allows malicious user's to exploit various security vulnerabilities and become the reason of their failure. Currently, SQL Injection (SQLl) and Cross-Site Scripting (XSS) vulnerabilities are most dangerous security vulnerabilities exploited in various popular web applications i.e. eBay, Google, Facebook, Twitter etc. Research on defensive programming, vulnerability detection and attack prevention techniques has been quite intensive in the past decade. Defensive programming is a set of coding guidelines to develop secure applications. But, mostly developers do not follow security guidelines and repeat same type of programming mistakes in their code. Attack prevention techniques protect the applications from attack during their execution in actual environment. The difficulties associated with accurate detection of SQLI and XSS vulnerabilities in coding phase of software development life cycle. This paper proposes a classification of software security approaches used to develop secure software in various phase of software development life cycle. It also presents a survey of static analysis based approaches to detect SQL Injection and cross-site scripting vulnerabilities in source code of web applications. The aim of these approaches is to identify the weaknesses in source code before their exploitation in actual environment. This paper would help researchers to note down future direction for securing legacy web applications in early phases of software development life cycle.

Cross Site Scripting: Detection Approaches in Web Application

“…This input can be fashioned to alter the contents of the web page that the victim can see, thus vesting the control with the attacker. The most standard approaches to spot vulnerabilities are categorised into dynamic analysis, static analysis, and hybrid analysis [15]. www.ijacsa.thesai.org…”

A Structured Analysis of SQL Injection Runtime Mitigation Techniques

“…Grupta et al [23] proposes a classification of the defense techniques of the static analysis based approaches. This survey paper explores eleven techniques from 2005 through 2012.…”

Web Security: Detection of Cross Site Scripting in PHP Web Application using Genetic Algorithm

“…A web application is a program that executes tasks over a network connection on a web server [18]. Such an application has to be accessed by means of an Internet browser.…”

“…The most popular approach to detect vulnerability can be classified into static, dynamic, and hybrid analyses [18]. Static analysis is a method that finds errors in early development that is before the program is initiated [16].…”