Web application protection against SQL injection attack

7th International Conference on Information Technology and Application, ICITA 2011

Volumn , Issue , 2011, Pages 1-7

  Alazab, Ammar ^a   Alazab, Moutaz ^a   Abawajy, Jemal ^a   Hobbs, Michael ^a  

^a DEAKIN UNIVERSITY   (Australia)

Author keywords

Cybercrime; SQL Injection; SQLIA; Vulnerabilities; Web Application Security

Indexed keywords

CYBERCRIME; SQL INJECTION; SQLIA; VULNERABILITIES; WEB APPLICATION SECURITY;

COMPUTER CRIME; PERSONAL COMPUTING; WEBSITES;

INFORMATION TECHNOLOGY;

EID: 84868144659     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (20)

1. D. Parsons, Dynamic Web Application Development Using XML and Java: Cengage Learning EMEA, 2008.
2. P. Bisht, P. Madhusudan, and V. Venkatakrishnan, "CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks," ACM Transactions on Information and System Security vol. 13, pp. 1-39, 2010.
3. C. Torrano-Gimenez, A. Perez-Villegas, and G. Alvarez, "WASAT-A New Web Authorization Security Analysis Tool," Web Application Security, pp. 39-49, 2010.
4. C. S. Peng, S. K. Chen, J. Y. Chung, A. Roy-Chowdhury, and V. Srinivasan, "Accessing existing business data from the World Wide Web," IBM Systems Journal, vol. 37, pp. 115-132, 2010.
5. W. D. Yu, D. Aravind, and P. Supthaweesuk, "Software vulnerability analysis for web services software systems," 2006, pp. 740-748.
6. K. J. Vella. (2007, 2011). Web Applications: What are they? What about them? Available: http://www.windowsecurity.com/articles/Web-Applications.html? printversion
7. W. G. J. Halfond, A. Orso, and P. Manolios, "Using positive tainting and syntax-aware evaluation to counter SQL injection attacks," 2006, pp. 175-185.
8. N. Jovanovic, C. Kruegel, and E. Kirda, "Pixy: A Static Analysis Tool for Detecting Web Application Vulnerabilities," in IEEE Symposium on Security and Privacy, Oakland, CA, 2006, pp. 258-263.
9. W. G. J. Halfond and A. Orso, "Preventing SQL injection attacks using AMNESIA," presented at the Proceedings of the 28th international conference on Software engineering, Shanghai, China, 2006.
10. IndraniBalasundaram and Ramaraj, "An Approach to Detect and Prevent SQL Injection Attacks in Database Using Web Service," International Journal of Computer Science and Network Security, vol. 11, pp. 197-205, 2011.
11. M. Martin, B. Livshits, and M. S. Lam, "Finding application errors and security flaws using PQL: a program query language," ACM SIGPLAN Notices, vol. 40, pp. 365-383, 2005.
12. Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo, "Securing web application code by static analysis and runtime protection," presented at the Proceedings of the 13th international conference on World Wide Web, New York, NY, USA, 2004.
13. C. Gould, Z. Su, and P. Devanbu, "JDBC checker: A static analysis tool for SQL/JDBC applications," 2004, pp. 697-698.
14. R. A. McClure and I. H. Krüger, "SQL DOM: compile time checking of dynamic SQL statements," 2005, pp. 88-96.
15. A. Nguyen-Tuong, S. Guarnieri, D. Greene, J. Shirley, and D. Evans, "Automatically hardening web applications using precise tainting," Security and Privacy in the Age of Ubiquitous Computing, pp. 295-307, 2005.
16. S. Bandhakavi, P. Bisht, P. Madhusudan, and V. Venkatakrishnan, "CANDID: preventing sql injection attacks using dynamic candidate evaluations," 2007, pp. 12-24.
17. D. Das, U. Sharma, and D. Bhattacharyya, "An Approach to Detection of SQL Injection Vulnerabilities Based on Dynamic Query Matching," International Journal of Computer Applications, vol. 1, pp. 39-45, 2010.
18. M. Alazab, S. Venkataraman, and P. Watters, "Towards Understanding Malware Behaviour by the Extraction of API Calls," in Second Cybercrime and Trustworthy Computing Workshop, Ballarat, VIC, 2010, pp. 52-59.
19. M. Alazab, S. Ventatraman, P. Watters, M. Alazab, and A. Alazab, "Cybercrime: The Case of Obuscated Malware," in 7th International Conference on Global Security, Safety & Sustainability, Thessaloniki, Greece, 2011.
20. C. Anley, "Advanced SQL Injection In SQL Server Applications," An NGSSoftware Insight Security Research (NISR) Publication, Next Generation Security Software Ltd, 2002.