UPM Institutional Repository

Enhanced pushdown automaton based static analysis for detection of SQL injection Hotspots in web application


Citation

Umar, Kabir and Md Sultan, Abu Bakar and Zulzalil, Hazura and Admodisastro, Novia Indriaty and Abdullah @ Selimun, Mohd Taufik (2016) Enhanced pushdown automaton based static analysis for detection of SQL injection Hotspots in web application. Indian Journal of Science and Technology, 9 (28). pp. 1-10. ISSN 0974-6846; ESSN: 0974-5645

Abstract

SQL injection Hotspots (SQLiHs) are Application’s Entry Points (AEPs) through which SQL injection is possible, subject to the application’s internal sanitization or validation capabilities. Since not all AEPs are SQLiHs, one serious challenge during testing of very large web application for detection of SQL Injection Vulnerabilities (SQLIVs) is how to reliably decide which AEPs to consider for the test and which AEPs are unnecessary? In this paper, we propose a new Pushdown Automaton (PDA) based static analysis technique for detection of SQLiHs in web applications. The goal is to produce concrete information that can reliably and confidently guide both human tester/developer and SQLIVs detection tools/techniques as to which part of the source code to concentrate their efforts during detection and fixing of SQL injection flaws in an application. The proposed technique is an integral part of an on-going research on automated method for detection and removal of SQLIVs in web application. Experimental evaluation of the method is in progress. However, preliminary results show that the proposed technique is both feasible and effective.


Download File

[img]
Preview
Text
Enhanced pushdown automaton based static analysis for detection of SQL injection Hotspots in web application.pdf

Download (71kB) | Preview

Additional Metadata

Item Type: Article
Subject: Context free grammar; Data flow path; Sensitive sink; Vulnerabilities
Divisions: Faculty of Computer Science and Information Technology
DOI Number: https://doi.org/10.17485/ijst/2016/v9i28/97808
Publisher: Indian Society for Education and Environment
Depositing User: Nurul Ainie Mokhtar
Date Deposited: 01 Mar 2018 08:37
Last Modified: 01 Mar 2018 08:37
Altmetrics: http://www.altmetric.com/details.php?domain=psasir.upm.edu.my&doi=10.17485/ijst/2016/v9i28/97808
URI: http://psasir.upm.edu.my/id/eprint/54163
Statistic Details: View Download Statistic

Actions (login required)

View Item View Item