A Static Analysis Framework for Detecting SQL Injection Vulnerabilities (2007)
Cached
Download Links
- [people.hofstra.edu]
- [wwwcsif.cs.ucdavis.edu]
- DBLP
Other Repositories/Bibliography
| Venue: | In Proceedings of 31st Annual International Computer Software and Applications Conference (COMPSAC 2007), pages 87 – 96 |
| Citations: | 19 - 4 self |
BibTeX
@INPROCEEDINGS{Fu07astatic,
author = {Xiang Fu and Xin Lu and Boris Peltsverger and Shijun Chen and Kai Qian and Lixin Tao},
title = {A Static Analysis Framework for Detecting SQL Injection Vulnerabilities},
booktitle = {In Proceedings of 31st Annual International Computer Software and Applications Conference (COMPSAC 2007), pages 87 – 96},
year = {2007}
}
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Recently SQL Injection Attack (SIA) has become a major threat to Web applications. Via carefully crafted user input, attackers can expose or manipulate the back-end database of a Web application. This paper proposes the construction and outlines the design of a static analysis framework (called SAFELI) for identifying SIA vulnerabilities at compile time. SAFELI statically inspects MSIL bytecode of an ASP.NET Web application, using symbolic execution. At each hotspot that submits SQL query, a hybrid constraint solver is used to find out the corresponding user input that could lead to breach of information security. Once completed, SAFELI has the future potential to discover more delicate SQL injection attacks than black-box Web security inspection tools.
Citations
No citations identified.
