Microsoft Word - 10 练坤梅.doc

Size: px

Start display at page:

Download "Microsoft Word - 10 练坤梅.doc"

魄毛房
5 years ago
Views:

1 ISSN CODEN JKYTA8 Journal of Frontiers of Computer Science and Technology /2011/05(05) Tel: DOI: /j.issn SQL * 练坤梅 +, 许静, 田伟, 张莹南开大学信息技术科学学院, 天津 Research on SQL Injection Vulnerability Multi-level Detection Method * LIAN Kunmei +, XU Jing, TIAN Wei, ZHANG Ying College of Information Technical Science, Nankai University, Tianjin , China + Corresponding author: laomattkl@gmail.com LIAN Kunmei, XU Jing, TIAN Wei, et al. Research on SQL injection vulnerability multi-level detection method. Journal of Frontiers of Computer Science and Technology, 2011, 5(5): Abstract: On the basis of an in-depth analysis of characteristics of SQL (structured query language) injection attacks and defense mechanisms related to SQL injection vulnerability, this paper grades the SQL injection vulnerability according to the level of defense degree, and takes the vulnerability grading as the basis for the equivalence partitioning of SQL injection fuzz testing case. After the optimized choice of SQL injection parameters, it detects the SQL injection vulnerabilities of target Web system initiatively and effectively by imitating hacker attacks, which makes the detection more target-oriented. The equivalence partition of SQL injection parameters ensures the completeness and no redundancy of fuzz testing. Key words: vulnerability detection; structured query language (SQL); SQL injection; grading; fuzz testing; equivalence partitioning 在深入分析 SQL(structured query language) 注入攻击特点攻击方式及 SQL 注入漏洞相关防御机制的基础上, 依据防御度的高低对 SQL 注入漏洞进行分级将漏洞分级作为 SQL 注入模糊测试用例等价类划分的依据, 对 SQL 注入参数进行优化选择后, 模拟黑客攻击的方式主动地有针对性地进行检测 SQL 注入参数的等价类划分保证了模糊测试过程的完备性和无冗余性 *The Science and Technology Program of Tianjin, China under Grant No. 08ZCKFGX01100 ( ). Received , Accepted

2 SQL 475 漏洞检测 ; 结构化查询语言 (SQL); SQL 注入 ; 分级 ; 模糊测试 ; 等价类划分 A TP311 1 Web, Web, Web, Web, Web SQL (SQL injection attack) Web, WWW, Web SQL,,,, NBSI MSSQL (Microsoft structured query language) Server ASP(active server page), MSSQL, ASP, AppScan, AppScan,, Web, SQL,, Web SQL, (filtering) (information-flow) (defensive coding),,, SQL,,,, [1], ( ), SQL URL(uniform resource location), HTTP(hyper text transport protocol),,,,, Web SQL,,,,,, 2 SQL (structured query language, SQL) SQL Web, Web,, SQL [2] SQL Web, 2010 (open Web application security project, OWASP) Top 10 [3], SQL SQL, Web SQL Web ( BBS ) SQL, SQL SQL, Web,,,

3 476 Journal of Frontiers of Computer Science and Technology 2011, 5(5), [4] SQL WWW, HTTP, Web, SQL,, HTTP URL cookie, ( telnet) Web SQL, SQL, Internet (Internet information services, IIS), SQL 3, SQL Web, SQL ; Web, Web, SQL, SQL, SQL, [5], SQL SQL, (fuzzing test), SQL [6] Miller UNIX,,,,,,,,,, bug,,, 4 SQL, Web, SQL ; Web SQL, SQL Web, SQL [7],, Web SQL Web, SQL ASP string sql = "select * from UserTable where user_name = '"+ user.text + "' and user_pwd = '"+ pass.text +"' "; abc' or 1=1--, -- SQL,, or 1=1, SQL where, Web SQL

4 SQL 477 SQL and, exec insert, select, delete, update, count, chr mid, master, truncate, char, declare, ', *, % Web / VBScript(Microsoft visual basic script edition),, AnD AND and UNICODE IIS URL unicode, IIS unicode %20, '=' %3D, and%201%3d1 and 1= ASCII ASCII, Web, A=chr(65),b=chr(98) and, aandnandd, Web and, and, Web, SQL, exec sp_userlogin 'joe', '123', 123';exec sp_password NULL, ' ', 'sa'--, Web SQL exec sp_ UserLogin 'joe', '123'; exec sp_password NULL, ' ', 'sa'--, sa Web SQL,,, SQL [7], SQL,, SQL SQL,,, SQL,,, SQL 5, SQL, SQL, ; SQL SELECT INSERT UPDATE DELETE, SQL, ( );, SQL ;, Web SQL, SQL, SQL ( )

5 478 Journal of Frontiers of Computer Science and Technology 2011, 5(5) URL,, SQL, SQL, 3, 1, 2, 1 6 Web, SQL SQL, SQL HTTP URL URL, URL { URL }+{? }, par1=val1&par2=val2&, SQL SQL, SQL, URL 0, ; SQL URL POST, Input ( username, password ) SQL, SQL, SQL, URL 0, ; SQL URL POST SQL Table 1 Equivalence partitioning table of SQL injection fuzz testing 1 SQL 0 (1) (2) SQL (3) (2) SQL 1 (4) UNICODE (8) (5) ASCII (6) (7) 2 (9) (10) Table 2 Equivalence partitioning testing case table of SQL injection fuzz testing 2 SQL ID 0 abc (3)(8)(10) 1 ', '' (1) 2 ' and '1'='1, ' and '1'='2 (2) 3 %27%20and%20%271%27%3D%271%27 %27%20and%20%271%27%3D%272%27 (4) 4 chr(96)chr(32)chr(97)chr(110)chr(100)chr(32)chr(96)chr(49)chr(96)chr(61)chr(96)chr(49)chr(96) chr(96)chr(32)chr(97)chr(110)chr(100)chr(32)chr(96)chr(49)chr(96)chr(61)chr(96)chr(50)chr(96) (5) 5 ' and '1'='1, 'and '1'='2 (6) 6 ' aandnandd '1'='1, 'aandnandd '1'='2 (7) 7 ';exec master..xp_cmdshell 'ping '-- (9)

6 SQL 479 Table 3 SQL injection vulnerability detection parameters at all levels and judgment logo 3 SQL 0 URL FORM 1 URL/FORM 2 URL/FORM ', ''( ) (1) ' and '1'='1 (2) ' and '1'='2 ' or '1'='1; '--; ' or 1=1 -- %' or '%'='%; %'--; %' or 1=1-- ', '' (1) (2),, 2xx UNICODE ASCII 0 0 (1) ';exec master..xp_cmdshell 'ping '-- (2) ';exec master..xpcmdshell 'dir'-- 3 URL/FORM SQL (1) ping (2) dir,, SQL ( ) SQL, URL,, SQL,, 3( ) SQL, JSP(Java server page) ASP SQL, SQL 4 Table 4 SQL injection vulnerability detection on grading 4 SQL JSP ASP /s /s /s SQL,, 7 SQL,, SQL, SQL,,,,, SQL,, SQL, SQL, References: [1] Yu Jing, Gao Feng, Xu Lianghua, et al. Research on penetration testing based on SQL injection[j]. Computer Engineering and Design, 2007, 28(15):

480 Journal of Frontiers of Computer Science and Technology 2011, 5(5) [2] Kals S, Kirda E, Kruegel C, et al.

[3] Williams J, Wichers D. OWASP top 10 2010 rc1[r]. Washington: OWASP, 2010. [4] Zhang Zhuo. SQL injection attack techniques and countermeasures analysis[d].

Changsha: National University of Defense Technology, 2005. [6] Yin Hong. Research and implementation of active scanner against loophole embedded in Web application program[d].

附中文参考文献 : [1],,,. SQL [J]., 2007, 28(15): 3577 3579. [4]. SQL [D]. :, 2007. [5]. Web [D]. :, 2005. [6]. Web [D]. :, 2005. [7] Stuttard D, Pinto M. [M].,. :, 2009: 160 201.

7 480 Journal of Frontiers of Computer Science and Technology 2011, 5(5) [2] Kals S, Kirda E, Kruegel C, et al. SecuBat: a Web vulnerability scanner[c]//proceedings of the 15th International Conference on World Wide Web, Edinburgh, Scotland, New York, NY, USA: ACM Press, 2006: [3] Williams J, Wichers D. OWASP top rc1[r]. Washington: OWASP, [4] Zhang Zhuo. SQL injection attack techniques and countermeasures analysis[d]. Shanghai: Shanghai Jiao Tong University, [5] Xu Liang. Research and implementation of Web application vulnerability scanning system based-on network[d]. Changsha: National University of Defense Technology, [6] Yin Hong. Research and implementation of active scanner against loophole embedded in Web application program[d]. Changsha: National University of Defense Technology, [7] Stuttard D, Pinto M. The Web application haker s handbook[m]. Shi Huayao. Beijing: Posts & Telecom Press, 2009: 附中文参考文献 : [1],,,. SQL [J]., 2007, 28(15): [4]. SQL [D]. :, [5]. Web [D]. :, [6]. Web [D]. :, [7] Stuttard D, Pinto M. [M].,. :, 2009: LIAN Kunmei was born in She is a master candidate at Nankai University. Her research interests include software engineering and software testing. (1984 ),,,,, XU Jing was born in She is a professor and doctoral supervisor at Nankai University. Her research interests include software engineering and software testing. (1967 ),,,,, TIAN Wei was born in He is a Ph.D. candidate at Nankai University. His research interests include software engineering and software testing. (1983 ),,,,, ZHANG Ying was born in She is a master candidate at Nankai University. Her research interests include software engineering and software testing. (1987 ),,,,,

Mechanical Science and Technology for Aerospace Engineering October Vol No. 10 Web SaaS B /S Web2. 0 Web2. 0 TP315 A

2012 10 31 10 Mechanical Science and Technology for Aerospace Engineering October Vol. 31 2012 No. 10 Web2. 0 400030 SaaS B /S Web2. 0 Web2. 0 TP315 A 1003-8728 2012 10-1638-06 Design and Implementation