SQL-injection vulnerability scanning tool for automatic creation of SQL-injection attacks

• Main Authors: Bashah Mat Ali, Abdul, Yaseen Ibrahim Shakhatreh, Ala’, Abdullah, Mohd Syazwan, Alostad, Jasem
• Format: Article
• Language: English
• Published: Elsevier Ltd 2011
• Subjects: QA76 Computer software
• Online Access: http://repo.uum.edu.my/4314/1/SQL-i.pdf; http://repo.uum.edu.my/4314/; http://dx.doi.org/10.1016/j.procs.2010.12.076
• Institution: Universiti Utara Malaysia

Securing the web against frequent cyber attacks is a big concern as attackers usually intend to snitch private information,financial information, deface and damages websites to prove their hacking capabilities. This type of vandalism may drive many corporations that conduct their business through the web to suffer financial and reputation damages. One of the most dangerous cyber attacks is the Structured Query Language (SQL)-injection attack, whereby this type of attack can be launched through the web browsers. The vulnerability of SQL-injection attack can be attributed to inappropriate programming practice by the website developers, which leaves a lot of doors widely open for the attackers to exploit these and gaining access to confidential information that resides in the website server databases.In order to address this vulnerability, it must be feasible to detect the vulnerability and enhance the coding structure of the website to avoid being an easy victim to this type of cyber attacks. Detecting the SQL-injection vulnerability requires the development of a powerful tool that can automatically create SQLinjection attacks using efficient features (different attacking patters) to detect the vulnerability of the websites. This paper discuss the development of a new web scanning (MySQLlInjector) tool with enhanced features that will be able to conduct efficient penetration test on PHP (started as Personal Home Page but now widely used as Hypertext Preprocesses) based websites to detect SQL injection vulnerabilities.This tool will automate the penetration test process, to make it easy even for those who are not aware familiar about hacking techniques.