ابزار اسکن آسیب پذیری تزریق SQL جهت ایجاد اتوماتیک حملات تزریق SQL

ABSTRACT SQL-injection vulnerability scanning tool for automatic creation of SQL-injection attacks

Penetration testing or web auditing is one of the most important topics that security researchers are concerned about. It aims to prove the effectiveness of the website security system because application level attacks rank at the top of nowadays cyber attacks as these are preferred by attackers/hackers. The philosophy behind web auditing is to ensure having a single entry point to web applications by performing penetration tests represented by conducting sophisticated attacks on websites. Having more than one entry point to the system will be considered as a security flaw that attracts potential hackers to exploit it. Moreover, penetration testing covers checking against a wide range of web vulnerabilities which are related to web application level vulnerabilities such as cross-site-scripting (XSS), SQL injection, IFRAME (Inline Frame) flaws, Domain Name Server (DNS) attacks, web authentication flaws, remote code execution, and remote file inclusion [1]. Exploiting any one of these vulnerabilities may enable remote attackers to gain administrative access to the infected website which enable them having the control to deface, damage and snitch credentials [2].

Penetration testing is recommended for those critical or popular websites as it is similar to trying to break into the organization’s IT systems. The aim of penetration testing is to demonstrate the robustness of the security system in order to expose the vulnerabilities and giving advice on how to recover these flaws [3]. Conducting penetration testing is an essential requirement for organizations that deal with critical or huge amount of data that may belong to hundreds and thousands of clients through an automated system or a website [4]. One of the most dangerous attacks that should be recovered in the penetration testing is the SQL injection attack that injects a malicious Javascript or HTML tags into the victim’s website database, or in other words executing malicious SQL queries to inject malicious HTML tags [5,6,1], which is considered as IFRAME attack. On the other hand IFRAME attack can also be carried out through what is known as cross site scripting attack (XSS) as this kind of attack can embed one malicious website in the original website to snitch credentials and to download malware on the visitor’s computer [4,2,1].

Web applications usually interact with backend databases and when the application receives a request from the user, it fetches the database by generating and executing SQL queries to interact with the relational database. These queries look for the requested data to be displayed in generated HTML pages to the user. In this normal scenario, the user inputs are treated as lexical entities. However, when the user inserts unexpected inputs that are not addressed in the web application’s dictionary, they will lead the web server to react abnormally. This may cause the web application to display unexpected data which may be classified as confidential and may be useful for the attacker.

This is known as command injection attack, and such commands could be SQL queries or operating system commands or Javascript & HTML tags. Command injection attack is widespread and more commands injection vulnerabilities will be discovered in the future [7,5,8].