Investigation of SQL Injection Attacks in Web Applications: Types, Attack Stages and a Comparison of Existing Countermeasures

References

[1] Agrawal J (2015). Mitigation of SQL Injection Attacks in PHP Web Applications. 04(12), 2291–2294. http://203.190.148.228:8080/xmlui/bitstream/handle/123456789/682/jyoti.pdf?sequence=2&isAllowed=y

[2] Ali S, Rauf A, Javed H (2009). SQLIPA: An authentication mechanism against SQL injection. European Journal of Scientific Research, 38(4), 604–611.

[3] Álvarez-Sánchez R, Andrade-Bazurto A, Santos-González I, Zamora-Gómez A (2018). AES-CTR as a password-hashing function. Advances in Intelligent Systems and Computing, 649, 610–617. https://doi.org/10.1007/978-3-319-67180-2_59

[4] Aziz B, Bader M, Hippolyte C (2016). Search-based SQL injection attacks testing using genetic programming. Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 9594(March), 183–198. https://doi.org/10.1007/978-3-319-30668-1_12

[5] Bansal Y, Park JH (2015). Multi-hashing for Protecting Web Applications from SQL Injection Attacks. International Journal of Computer and Communication Engineering, 4(3), 187–195. https://doi.org/10.17706/ijcce.2015.4.3.187-195

[6] Batubara TP, Efendi S, Nababan EB (2021). Analysis Performance BCRYPT Algorithm to Improve Password Security from Brute Force. Journal of Physics: Conference Series. https://doi.org/10.1088/1742-6596/1811/1/012129

[7] Bhattacharyya P, Sastry HG, Marriboyina V, Sharma R (2017). Smart and Innovative Trends in Next Generation Computing Technologies Communications in Computer and Information Science 828. http://www.springer.com/series/7899

[8] Bidhuri V, Heffernan N, Heffernan N (n.d.). Enhancing Password Security Using a Hybrid Approach of SCrypt Hashing and AES Encryption MSc Internship Cyber Security National College of Ireland Supervisor :

[9] Chen D, Yan Q, Wu C, Zhao J (2021). SQL Injection Attack Detection and Prevention Techniques Using Deep Learning. Journal of Physics: Conference Series, 1757(1). https://doi.org/10.1088/1742-6596/1757/1/012055

[10] Dehariya H, Kumar P, Ahirwar M (2016). A Survey on Detection and Prevention Techniques of SQL Injection Attacks. International Journal of Computer Applications, 137(5), 9–15. https://doi.org/10.5120/ijca2016908672

[11] Dubey R, Gupta H (2016). SQL filtering: An effective technique to prevent SQL injection attack. 2016 5th International Conference on Reliability, Infocom Technologies and Optimization, ICRITO 2016: Trends and Future Directions, 312–317. https://doi.org/10.1109/ICRITO.2016.7784972

[12] Durai KN, Subha R, Haldorai A (2021). A Novel Method to Detect and Prevent SQLIA Using Ontology to Cloud Web Security. Wireless Personal Communications, 117(4), 2995–3014. https://doi.org/10.1007/s11277-020-07243-z

[13] Elshazly K, Fouad Y, Saleh M, Sewisy A (2014). A Survey of SQL Injection Attack Detection and Prevention. Journal of Computer and Communications, 02(08), 1–9. https://doi.org/10.4236/jcc.2014.28001

[14] Fu X, Lu X, Peltsverger B, Chen S, Qian K, Tao L (2007). A static analysis framework for detecting SQL injection vulnerabilities. Proceedings - International Computer Software and Applications Conference, 1(Compsac), 87–94. https://doi.org/10.1109/COMPSAC.2007.43

[15] Ganesh Kadam K, Khairnar V (2015). Hybrid Rsa-Aes Encryption for Web Services an Implementation of Hybrid Encryption-Decryption (Rsa With Aes and Sha256) for Use in Data Exchange Between Client Applications and Web Services. International Journal of Technical Research and Applications, 31(31), 51–56. www.ijtra.com

[16] Gupta H, Mondal S, Ray S, Giri B, Majumdar R, Mishra VP (2019). Impact of SQL Injection in Database Security. Proceedings of 2019 International Conference on Computational Intelligence and Knowledge Economy, ICCIKE 2019, February 2020, 296–299. https://doi.org/10.1109/ICCIKE47802.2019.9004430

[17] Halfond WGJ, Orso A, Manolios P (2008a). WASP: Protecting web applications using positive tainting and syntax-aware evaluation. IEEE Transactions on Software Engineering, 34(1), 65–81. https://doi.org/10.1109/TSE.2007.70748

[18] Halfond WGJ, Viegas J, Orso A (2008b). A Classification of SQL Injection Attacks and Countermeasures. Preventing Sql Code Injection By Combining Static and Runtime Analysis, 53.

[19] Hardy DW, Richman F, Walker CL (2020). Advanced Encryption Standard. Applied Algebra, 275–290. https://doi.org/10.1201/9781439894699-15

[20] Heron S (2009). Advanced Encryption Standard (AES). Network Security, 2009(12), 8–12. https://doi.org/10.1016/S1353-4858(10)70006-4

[21] Idrus SZS, Aljunid SA, Asi SM, Sudin S, Ahmad RB (2008). Performance Analysis of Encryption Algorithms Text Length Size on Web Browsers. IJCSNS International Journal of Computer Science and Network Security, 8(1), 20–25.

[22] Jiang GL, Wu J, Liu K, Fu BZ, Chen MY (2014). Implementation and performance analysis of SDN controller. Dongbei Daxue Xuebao/Journal of Northeastern University, 35, 313–318.

[23] Kao DY, Lai CJ, Su CW (2019). A Framework for SQL Injection Investigations: Detection, Investigation, and Forensics. Proceedings - 2018 IEEE International Conference on Systems, Man, and Cybernetics, SMC 2018, 2838–2843. https://doi.org/10.1109/SMC.2018.00483

[24] Li Y, Zhang B (2019). Detection of SQL Injection Attacks Based on Improved TFIDF Algorithm. Journal of Physics: Conference Series, 1395(1). https://doi.org/10.1088/1742-6596/1395/1/012013

[25] Malvoni K, Knezovic J (2014). Are your passwords safe: Energy-efficient Bcrypt cracking with low-cost parallel hardware. 8th USENIX Workshop on Offensive Technologies, WOOT 2014, Algorithm 1.

[26] Marton K, Suciu A, Ignat I (2010). Randomness in digital cryptography: A survey. Romanian Journal of Information Science and Technology, 13(3), 219–240.

[27] Musliyana Z, Arif TY, Munadi R (2015). Security enhancement of Advanced Encryption Standard (AES) using time-based dynamic key generation. ARPN Journal of Engineering and Applied Sciences, 10(18), 8347–8350.

[28] Muttaqin MF, Yaddarabullah, Permana SDH (2020). Implementation of aes-128 and token-base64 to prevent sql injection attacks via http. International Journal of Advanced Trends in Computer Science and Engineering, 9(3), 2876–2882. https://doi.org/10.30534/ijatcse/2020/60932020

[29] Nagpal B, Chauhan N, Singh N (2017). A survey on the detection of SQL injection attacks and their countermeasures. Journal of Information Processing Systems, 13(4), 689–702. https://doi.org/10.3745/JIPS.03.0024

[30] Padmanabhan S (2012). Hacking for Lulz: Employing Expert Hackers to Combat Cyber Terrorism. Vand. J. Ent. & Tech. L., 15(1), 191–226. http://www.jetlaw.org/wp-content/pdf/Padmanabhan.pdf

[31] Padmavathi B, Kumari SR (2013). A Survey on Performance Analysis of DES, AES and RSA Algorithm along with LSB Substitution Technique. International Journal of Science and Research, 2(4), 2319–7064. www.ijsr.net

[32] Philippaerts P, Younan Y, Muylle S, Piessens F, Lachmund S, Walter T (2011). Code pointer masking: Hardening applications against code injection attacks. Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 6739 LNCS(July), 194–213. https://doi.org/10.1007/978-3-642-22424-9_12

[33] Savage A (2008). MD5 and SHA-1 Collision Attacks: A Tutorial. 5, 1–4. https://koclab.cs.ucsb.edu/teaching/cren/project/2008/savage.pdf

[34] Shahriar H, Zulkernine M (2012). Information-theoretic detection of SQL injection attacks. Proceedings of IEEE International Symposium on High Assurance Systems Engineering, 40–47. https://doi.org/10.1109/HASE.2012.31

[35] Singh G, Supriya S (2013). A Study of Encryption Algorithms (RSA, DES, 3DES and AES) for Information Security. International Journal of Computer Applications, 67(19), 33–38. https://doi.org/10.5120/11507-7224

[36] Tajpour A, Shooshtari MJZ (2010). Evaluation of SQL injection detection and prevention techniques. Proceedings - 2nd International Conference on Computational Intelligence, Communication Systems and Networks, CICSyN 2010, July, 216–221. https://doi.org/10.1109/CICSyN.2010.55

[37] Turan MS, Barker E, Burr W, Chen L (2010). Recommendation for password-based key derivation: part 1: storage applications. NIST Special Publication, December, 800–132. http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf

[38] Varshney K, Ujjwal RL (2019). LsSQLIDP : Literature survey on SQL injection detection and prevention techniques. Journal of Statistics and Management Systems, 22(2), 257–269. https://doi.org/10.1080/09720510.2019.1580904

[39] Xuelong (2011). Implementation of an Improved Data Encryption Algorithm in a Web Based Learning System. Physics International, 2(1), 31–35. https://doi.org/10.3844/pisp.2011.31.35

@article{1724142,
      author = {Emmanuel Abiodun Oyeneyin},
      title = {Investigation of SQL Injection Attacks in Web Applications: Types, Attack Stages and a Comparison of Existing Countermeasures},
      journal = {Iconic Research And Engineering Journals},
      year = {2022},
      volume = {6},
      number = {2},
      pages = {476-493},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1724142.pdf},
      abstract = {In this digital age, the web application is one of the core aspects of technology that is transforming the world into one village. Many commercial companies rely heavily on web applications for their daily business transactions as well as educational initiatives and a variety of other activities. Unfortunately, this platform has attracted hackers because of the nature of data on a database. An attacker could retrieve, update, and even destroy the data on a database using a crafted technique known as SQL injection. SQL injection attacks can affect the confidentiality, integrity and availability of data on a web application. This paper investigates SQL injection threats in web applications. A web application that is vulnerable to SQL injection was developed and used to examine the common types of SQL injection attacks (tautology, piggy-backed query, logically incorrect query, union query, stored procedure, alternate encoding and inference-based), the stages through which an attack passes, and the existing techniques proposed against it. The existing techniques are compared against the types of SQL injection and on the basis of their tool requirements and limitations. The paper also reviews hash and encryption algorithms as countermeasures, and finds the Bcrypt hash algorithm and the Advanced Encryption Standard (AES) to be the more robust options for protecting the data on a database.},
      keywords = {SQL injection; web application security; SQLIA; cryptography; Bcrypt; Advanced Encryption Standard; database security},
      month = {August},
  }