ART4SQLi: The ART of SQL Injection Vulnerability Discovery

• Published in: IEEE transactions on reliability 2019-12, Vol.68 (4), p.1470-1489
• Main Authors: Zhang, Long, Zhang, Donghong, Wang, Chenghong, Zhao, Jing, Zhang, Zhenyu
• Format: Article
• Language: English
• Subjects: Adaptive random testing (ART); Applications programs; attack payload; Authentication; Benchmarks; Cost analysis; Dynamic tests; Feature extraction; Payloads; Query languages; Security; SQL injection (SQLi); Subspace constraints; Task analysis; test case prioritization; Testing
• ISSN: 0018-9529; 1558-1721
• DOI: 10.1109/TR.2019.2910285

SQL injection (SQLi) is one of the chief threats to the security of database-driven Web applications. It can cause serious security issues such as authentication bypassing, privacy leakage, and arbitrary code execution. Dynamic testing techniques are used in SQLi vulnerability discovery, which de-facto approach is to maintain a collection of elaborately designed user inputs (aka. attack payloads) and based on it to compose malicious SQL queries to Web applications. Such techniques are effective to reveal SQLi threats before an application is released, thus reducing the cost of manual analysis, monitoring or postdeployment of other defensive mechanisms. However, because of the diversity of SQLi attacks and the difficulty of SQLi discovery, the process to execute payloads can be costly, time-consuming, and even risky. In this paper, we approach from a test case prioritization perspective to give a more effective SQLi discovery proposal, which is based on adaptive random testing with the aim to successfully trigger an SQLi within limited attempts. To evaluate our method, we conduct an experiment using three extensively adopted open source vulnerable benchmarks. The experiment results indicate that our method ART4SQLi can effectively improve the conventional random testing approach on three common benchmarks by more than 26% in reducing the number of SQLi attempts before accomplishing a successful injection.