Textual Manipulation for SQL Injection Attacks
Автор: Hussein AlNabulsi, Izzat Alsmadi, Mohammad Al-Jarrah
Журнал: International Journal of Computer Network and Information Security(IJCNIS) @ijcnis
Статья в выпуске: 1 vol.6, 2013 года.
Бесплатный доступ
SQL injection attacks try to use string or text manipulations to access illegally websites and their databases. This is since using some symbols or characters in SQL statements may trick the authentication system to incorrectly allow such SQL statements to be processed or executed. In this paper, we highlighted several examples of such text manipulations that can be successfully used in SQL injection attacks. We evaluated the usage of those strings on several websites and web pages using SNORT open source. We also conducted an extensive comparison study of some relevant papers.
Network security, vulnerability, Intrusion detection systems, SNORT, vulnerability assessment, rule-based detection
Короткий адрес: https://sciup.org/15011263
IDR: 15011263
Список литературы Textual Manipulation for SQL Injection Attacks
- U Aickelin, J Twycross and T HeskethRoberts, "Rule Generalisation using Snort", International Journal of Electronic Security and Digital Forensics (IJESDF), April 2008.
- Martin Roesch, "Snort — Light Weight Intrusion Detection For Networks", Proceedings of LISA '99: 13th Systems Administration Conference, November 1999.
- Mohammad Dabbour, Izzat Alsmadi and Emad Alsukhni, ‖Efficient Assessment and Evaluation for Websites Vulnerabilities Using SNORT‖, International Journal of Security and its Applications IJAST, Vol. 7, No. 1, January 2013.
- Ashley Deuble, ―Detecting and Preventing Web Application Attacks with Security Onion‖, SANS Institute, 26th July 2012.
- Brad Warneck, ―Defeating SQL Injection IDS Evasion‖, SANS Institute, January 4th 2007.
- K. K. Mookhey, Nilesh Burghate, "Detection of SQL Injection and Cross-site Scripting Attacks‖, SecurityFocus Infocus article, Created March 2004, Updated Nov 2010.
- Gerrie Veerman, Razvan Oprea, ―Database SQL Injections Detection & Protection‖, University van Amsterdam, May 30, 2012.
