Fault-based testing for discovering SQL injection vulnerabilities in web applications

Izzat Alsmadi; Ahmed AlEroud; Ahmad A. Saifan

doi:10.1504/IJICS.2021.117394

Fault-based testing for discovering SQL injection vulnerabilities in web applications

Izzat Alsmadi, Ahmed AlEroud, Ahmad A. Saifan

Research output: Contribution to journal › Article › peer-review

2 Scopus citations

Abstract

In this paper we proposed a model to investigate the behaviour of websites when dealing with invalid inputs. Many vulnerabilities rise from invalid inputs. An invalid input is considered as a form of a successful attack if it is processed by the website code or back-end database. Based on this assumption, we proposed a list of indicators that tested and processed invalid inputs. A tool is developed to implement this model. We tested the model through evaluating several websites selected randomly. Our tool has no special credentials or access to any of the tested websites. We found many SQL injection vulnerabilities based on our proposed model. Upon the manual investigation of the web pages that showed such vulnerabilities, we found few instances of false positives. We believe that this can provide a systematic and automated approach to test websites for vulnerabilities related to improper input validation.

Original language	English (US)
Pages (from-to)	51-62
Number of pages	12
Journal	International Journal of Information and Computer Security
Volume	16
Issue number	1-2
DOIs	https://doi.org/10.1504/IJICS.2021.117394
State	Published - 2021
Externally published	Yes

Keywords

SQL-injection attacks
Security
Software testing
Web applications

ASJC Scopus subject areas

Software
Safety, Risk, Reliability and Quality
Hardware and Architecture
Computer Networks and Communications

Access to Document

10.1504/IJICS.2021.117394

Cite this

@article{ade2bae9886d437596afbabe47f4f624,

title = "Fault-based testing for discovering SQL injection vulnerabilities in web applications",

abstract = "In this paper we proposed a model to investigate the behaviour of websites when dealing with invalid inputs. Many vulnerabilities rise from invalid inputs. An invalid input is considered as a form of a successful attack if it is processed by the website code or back-end database. Based on this assumption, we proposed a list of indicators that tested and processed invalid inputs. A tool is developed to implement this model. We tested the model through evaluating several websites selected randomly. Our tool has no special credentials or access to any of the tested websites. We found many SQL injection vulnerabilities based on our proposed model. Upon the manual investigation of the web pages that showed such vulnerabilities, we found few instances of false positives. We believe that this can provide a systematic and automated approach to test websites for vulnerabilities related to improper input validation.",

keywords = "SQL-injection attacks, Security, Software testing, Web applications",

author = "Izzat Alsmadi and Ahmed AlEroud and Saifan, {Ahmad A.}",

note = "Funding Information: and undergraduate level courses on enterprise information systems (EIS), databases, data mining, and information security. His research work focuses on data integration, cyber security, data mining, and for privacy-preserving network data analytics, and detection of social engineering attacks and social media analytics. His research has been partially funded by the US-based Maryland Technology Development Corporation (TEDCO) in order to commercialise his research in the industry. Publisher Copyright: Copyright {\textcopyright} 2021 Inderscience Enterprises Ltd.",

year = "2021",

doi = "10.1504/IJICS.2021.117394",

language = "English (US)",

volume = "16",

pages = "51--62",

journal = "International Journal of Information and Computer Security",

issn = "1744-1765",

publisher = "Inderscience Enterprises Ltd",

number = "1-2",

}

TY - JOUR

T1 - Fault-based testing for discovering SQL injection vulnerabilities in web applications

AU - Alsmadi, Izzat

AU - AlEroud, Ahmed

AU - Saifan, Ahmad A.

N1 - Funding Information: and undergraduate level courses on enterprise information systems (EIS), databases, data mining, and information security. His research work focuses on data integration, cyber security, data mining, and for privacy-preserving network data analytics, and detection of social engineering attacks and social media analytics. His research has been partially funded by the US-based Maryland Technology Development Corporation (TEDCO) in order to commercialise his research in the industry. Publisher Copyright: Copyright © 2021 Inderscience Enterprises Ltd.

PY - 2021

Y1 - 2021

N2 - In this paper we proposed a model to investigate the behaviour of websites when dealing with invalid inputs. Many vulnerabilities rise from invalid inputs. An invalid input is considered as a form of a successful attack if it is processed by the website code or back-end database. Based on this assumption, we proposed a list of indicators that tested and processed invalid inputs. A tool is developed to implement this model. We tested the model through evaluating several websites selected randomly. Our tool has no special credentials or access to any of the tested websites. We found many SQL injection vulnerabilities based on our proposed model. Upon the manual investigation of the web pages that showed such vulnerabilities, we found few instances of false positives. We believe that this can provide a systematic and automated approach to test websites for vulnerabilities related to improper input validation.

AB - In this paper we proposed a model to investigate the behaviour of websites when dealing with invalid inputs. Many vulnerabilities rise from invalid inputs. An invalid input is considered as a form of a successful attack if it is processed by the website code or back-end database. Based on this assumption, we proposed a list of indicators that tested and processed invalid inputs. A tool is developed to implement this model. We tested the model through evaluating several websites selected randomly. Our tool has no special credentials or access to any of the tested websites. We found many SQL injection vulnerabilities based on our proposed model. Upon the manual investigation of the web pages that showed such vulnerabilities, we found few instances of false positives. We believe that this can provide a systematic and automated approach to test websites for vulnerabilities related to improper input validation.

KW - SQL-injection attacks

KW - Security

KW - Software testing

KW - Web applications

UR - http://www.scopus.com/inward/record.url?scp=85114555122&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85114555122&partnerID=8YFLogxK

U2 - 10.1504/IJICS.2021.117394

DO - 10.1504/IJICS.2021.117394

M3 - Article

AN - SCOPUS:85114555122

SN - 1744-1765

VL - 16

SP - 51

EP - 62

JO - International Journal of Information and Computer Security

JF - International Journal of Information and Computer Security

IS - 1-2

ER -

Fault-based testing for discovering SQL injection vulnerabilities in web applications

Abstract

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this