SQL-Injection Vulnerability Scanner Using Automatic Creation of SQL-Injection Attacks (MySqlinjector)

• Main Author: Shakhatreh, Ala' Yaseen Ibrahim
• Format: Thesis
• Language: English; English
• Published: 2010
• Subjects: QA71-90 Instruments and machines
• Online Access: https://etd.uum.edu.my/2141/1/Ala%27_Yaseen_Ibrahim_Shakhatreh.pdf; https://etd.uum.edu.my/2141/2/1.Ala%27_Yaseen_Ibrahim_Shakhatreh.pdf; https://etd.uum.edu.my/2141/
• Institution: Universiti Utara Malaysia

Securing the web against frequent cyber attacks is a big concern, attackers usually intend to snitch private info, deface, and damage websites, to prove their identities, this kind of vandalism may drive many corporations which conduct their business through the web to fall down. One of the most dangerous cyber attacks is SQL-injection attack, this kind of attack can be launched through the web browsers. The vulnerability of SQL injection can be resulted from inappropriate programming practice, which leaves a lot of doors wide opened to the attackers to exploit them, and to gain the access to confidential info. In order to get rid of this vulnerability, it is feasible to detect it and enhance the coding structure of the system to avoid being an easy victim to this kind of cyber attacks, this kind of detection requires a powerful tool that can automatically create SQL-injection attacks using efficient features to detect the vulnerability. This study introduces a new web scanning tool (MySqlInjector) with enhanced features that will be able to conduct efficient penetration test on PHP based websites to detect SQL injection vulnerabilities. This tool will automate the penetration test process, to make it easy even for those who are not aware about hacking techniques.