Analysis & detection of SQL injection vulnerabilities via automatic test case generation of programs

Proceedings - 2010 10th Annual International Symposium on Applications and the Internet, SAINT 2010

Volumn , Issue , 2010, Pages 31-37

  Ruse, Michelle ^a   Sarkar, Tanmoy ^a   Basu, Samik ^a  

^a Iowa State University   (United States)

Author keywords

Assertion; Decision diagrams; Program verification; SQL injection; Test cases

Indexed keywords

ASSERTION; DECISION DIAGRAM; PROGRAM VERIFICATION; SQL INJECTION; TEST CASE;

COMPUTER CRIME; INTERNET;

QUERY LANGUAGES;

EID: 78649275346     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SAINT.2010.60     Document Type: Conference Paper

References (11)

1. S. W. Boyd and A. D. Keromytis. SQLrand: Preventing SQL injection attacks. In Applied Cryptography and Network Security (ACNS) Conference, 2004.
2. M. Bravenboer, E. Dolstra, and E. Visser. Preventing injection attacks with syntax embeddings. In ACM Conference on Generative Programming and Component Engineering, 2007.
3. G. Buehrer, B. W. Weide, and P. A. G. Sivilotti. Using parse tree validation to prevent SQL injection attacks. In ACM Workshop on Software Engineering and Middleware, 2005.
4. W. G. J. Halfond and A. Orso. AMNESIA: Analysis and monitoring for neutralizing SQL-injection attacks. In IEEE/ACM international Conference on Automated software engineering, 2005.
5. W. G. J. Halfond, A. Orso, and P. Manolios. Using positive tainting and syntax-aware evaluation to counter SQL injection attacks. In ACM SIGSOFT Foundations of Software Engineering (FSE), 2006.
6. M. Huth and M. Ryan. Logic in Computer Science: Modelling and Reasoning about Systems, chapter 6. Cambridge University Press, 2004.
7. M. Martin and M. S. Lam. Automatic generation of XSS and SQL injection attacks with goal-directed model checking. In USENIX Security symposium, 2008.
8. A. S. Miner. Implicit GSPN reachability set generation using decision diagrams. Performance Evaluation, 56(1-4):145-165, 2004.
9. M. Rice and S. Kulhari. A survey of static variable ordering heuristics for efficient BDD/MDD construction. Technical report, UC Riverside, 2008.
10. Z. Su and G. Wassermann. The essence of command injection attacks in web applications. In ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, 2006.
11. G. Wassermann and Z. Su. Sound and precise analysis of web applications for injection vulnerabilities. In ACM Conference on Programming Language Design and Implementation, 2007.