Review of Tools against Vulnerabilities in

Web Applications
Nilesh Kunhare Prof. B.N.Roy
Department of Computer Science Department of Computer Science
Research Scholar MANIT MANIT
Bhopal, India Bhopal, India
[email protected]

Abstract—We know that nowadays many of our static analysis, defensive coding, test generation
daily activities takes place by using web and dynamic monitoring. Each of these
applications such as shopping, communications, approaches has its own merits, but there are
research etc. The attackers target the victims either possibilities for improvement. Static analysis
for commercial reason or for personal gain. This is tools can produce false warnings and do not
why they are often vulnerable to attacks like create concrete examples of inputs that exploit
HTML Embedding, Buffer Overflow, SQL
the vulnerabilities. Defensive coding is error-
Injection, Cross-site Scripting etc. Research data
shows that about 90% of web applications are prone and requires rewriting existing software to
vulnerable to SQL Injection (SQLI) and Cross-site use safe libraries. Black-box test generation does
Scripting (XSS) attacks. Many tools and techniques not take advantage of the application’s internals,
have been developed to prevent and detect these whereas previous White- box techniques have
attacks. In this paper we will review about these not been shown to discover unknown
tools with their strength and weaknesses. We will vulnerabilities. Dynamic monitoring tools
also discuss about the XSS attack and its types outcomes in runtime overhead on the running
which is considered to be more dangerous than application and do not detect vulnerabilities until
SQLI attacks.
the code has been deployed.
Keywords—Web applications, Victims, II. BACKGROUND
Vulnerable, SQL Injection, Cross-site Scripting.
The SQL injection attack used to exploit the web
I. INTRODUCTION application remotely without any application or
database authentication. By sending crafted input
Two types of attacks are most common and a malicious user can change the SQL statement
damaging. SQL Injection attack occurs when the structure and execute arbitrary SQL commands
attacker is able to insert a series of SQL on the vulnerable system. Consider the following
statements into a query by manipulating data username and password example, in order to
input into an application. SQLI attack is among login to the web site, the user inputs his
the most common database attacks which try to username and password, by clicking on the
access the sensitive data directly. Whereas XSS submit button the following SQL query is
attack occurs when a user clicks on crafted generated:-
malicious URLs or visit the infected page. The SELECT * FROM emptable WHERE eid =‘e#1’
malicious script is executed on client’s web and password = ‘54321’
server. XSS attack results in cookie stealing, The query will be executed when user input the
changing user’s account information and its following password:
privileges etc. The XSS attack is similar to SQLI
as they follow the same attacking style of code ‘Or 1=1 –
injection, but they are different from each other.
The SQLI attack performs to access and The SQL query will become:
manipulate the application’s database whereas in
XSS attack, the attacker focuses on injecting SELECT * FROM emptable WHERE eid=‘e#1’
malicious code to application’s users. Previous and password = ‘54321’ or 1=1 --'. The query
approaches identifying against SQLI and XSS will return all rows from the database regardless
vulnerabilities and preventing exploits include
of whether eid=’e#1’ and SQL INJECTION DETECTION AND
password=’54321’.This is because the ‘1’=’1’ PREVENTION TECHNIQUES
will always return true result and OR statement
appended to the WHERE clause. Therefore, the We discussed about various types of SQL
query will return a non-empty result set without Injection attack types. Now we will discuss
any error. SQL injection problem can be solved about the prevention and detection tools [3] for
by checking all SQL statements before sending such attack types.
them to the database. There are various SQL Wassermann and Su propose Tautology Checker
injection prevention and detection techniques that uses static analysis to stop tautology attack.
developed [2]. In this paper we will review about The weakness of this tool is that its scope is
these techniques with their strength and limited to tautology and cannot detect or prevent
weaknesses. First we will discuss about various other types of attacks.
SQL Injection attack types then we will discuss CANDID modifies web applications written in
about the tools developed for protecting against Java through a program transformation. This tool
these attack types. dynamically mines the programmer-intended
query structure on any input and detects attacks
SQL INJECTION ATTACK TYPES by comparing it against the structure of the
actual query issued. It’ natural and simple
There are different methods of attacks that approaches turns out to be very powerful for
depending on the goal of attacker are performed detection of SQL injection attacks.
together or sequentially. For a successful SQLIA AMNESIA combines static analysis and runtime
the attacker should append a syntactically correct monitoring. In static phase, it builds models of
command to the original SQL query. Now the the different types of queries which an
following classification of SQLIAs in application can legally generate at each point of
accordance to the Halfond, Viegas and Orso access to the database. Queries are intercepted
researcher will be presented. before they are sent to the database and are
1. IIIegal/Logically Incorrect Queries: Finding checked against the statically built models, in
vulnerabilities through error messages. dynamic phase. Queries that violate the model
2. Piggy-backed Queries: In this type of attack, are prevented from accessing to the database.
the original query is appended by the query The primary limitation of this tool is that its
delimiter such as”;” to append extra query. success is dependent on the accuracy of its static
3. Tautologies: the conditional query statement is analysis for building query models.
evaluated always true like exploiting Two similar approaches by Nguyen-Tuong and
vulnerabilities in the database using WHERE Pietraszek, modify a PHP interpreter to track
clause. precise per-character taint information. A context
4. Union Query: the attacker use the SQL tokens sensitive analysis is used to detect and reject
with the word UNION to injected query and queries if certain types of SQL tokens has been
then get data about other tables from the constructed by illegitimate input. Limitation of
application. these two approaches is that they require
5. Inference: By this type of attack, intruders rewriting code.
change the behavior of a database or application. Livshits and Lam use static analysis techniques
(a) Blind injection: stealing data by asking a to detect vulnerabilities in software. Java Static
series of True False questions through SQL Tainting uses information flow techniques to
statements. detect when tainted input has been used to make
(b) Timing attacks: By observing timing delays a SQLIA. The primary limitation of this
in the database's responses. approach is that it can detect only known
6. Alternate Encodings: modify the injection patterns of SQLIAs and it can generate a
query by using alternate encoding, such as relatively high amount of false positives because
hexadecimal, ASCII, and Unicode. Because by it uses a conservative analysis.
this way they can escape from developer's filter SQLPrevent is consists of an HTTP request
which scan input queries for special known "bad interceptor. The original data flow is modified
character". when SQLPrevent is deployed into a web server.
7. Stored Procedure: Stored procedure is a part The HTTP requests are saved into the current
of database that programmer could set an extra thread-local storage. Then, SQL interceptor
abstraction layer on the database. intercepts the SQL statements that are made by
web application and pass them to the SQLIA
detector module. Consequently, HTTP request with HTML and JavaScript (other being
from thread local storage is fetched and VBScript, ActiveX, or Flash) as the prime
examined to determine whether it contains an culprits for this exploit. The concept of XSS is to
SQLIA. The malicious SQL statement would be manipulate client-side scripts of a web
prevented to be sent to database, if it is application to execute in the manner desired by
suspicious to SQLIA. the malicious user. Such a manipulation can
JDBC-Checker was not developed with the embed a script in a page which can be executed
intent of detecting and preventing general every time the page is loaded, or whenever an
SQLIAs, but can be used to prevent attacks that associated event is performed. There are
take advantage of type mismatches in a different types of XSS attacks.
dynamically-generated query string. As most of 1. Non-Persistent or Reflected Attack (First
the SQLIAs consist of syntactically and type Order XSS): The most common attack,
correct queries so this technique would not catch Considered less dangerous. Usually used in
more general forms of these attacks. phishing attempts. Attack requires to persuade
Xiang Fu and Kai Qian proposed the design of a the victim to click on a prepared URL (Social
static analysis framework, called SAFELI for Engineering).It can steal credential, deface a
identifying SQLIA vulnerabilities at compile website, create a fake page or spam email,
time. SAFELI statically monitor the MSIL observe user request etc.
(Microsoft Symbolic intermediate language) byte 2. Persistent XSS Attack (or Stored or Second
code of an ASP .NET Web application, using Order XSS Attack): Similar to Non-persistent,
symbolic execution. SAFELI can analyze the but even more effective. It is Stored in the
source code and will be able to identify delicate attacked web server’s database. Second-order
vulnerabilities that cannot be discovered by XSS is much more damaging than first order
black-box vulnerability scanners. The main XSS, for two reasons: (a) social engineering is
drawback of this technique is that this approach not required (the attacker can directly supply the
can discover the SQL injection attacks only on malicious input without tricking users into
Microsoft based product. clicking on a URL), and (b) a single malicious
Two approaches, SQL DOM and Safe Query script planted once into a database executes on
Objects, use database queries encapsulation for the browsers of many victim users.
trustable access to databases. They use a type-
checked API which cause query building process III. RELATED WORK
is systematic. Consequently by API they apply
coding best practices such as input filtering and XSS has proven to be dangerous enough to
strict user input type checking. The drawback of consider and researches on Cross-site scripting
the approaches is that developer should learn attacks has been ongoing for a number of years
new programming paradigm or query- now, and a large number of protection methods
development process. have been researched and tested, such as
Java Dynamic Tainting and SecuriFly is another Modularized and configured solution to block
tool that was implemented for java. We XSS vulnerabilities based on service oriented
discussed about the tools used for protecting architecture [4], Static Detection of Cross-Site
against SQL Injection attack. Now we will Scripting Vulnerabilities [5] but these researches
discuss about another type of attack which is are helpful to avoid simple XSS attack, they are
considered to be most dangerous than SQLI for not able to detect Persistent XSS attack which is
web applications. We discussed about SQLI considered to be more dangerous than simple
attack types, their prevention and detection and first order attack. So our work area will be
techniques. Now further we will discuss about focus on persistent XSS attack. In order to detect
XSS attack and its types, which is considered to persistent XSS attack we will study about the
be more dangerous than SQLI attack. attacker’s scenario and understanding its
Cross-Site Scripting Attack: (or XSS attack) is behavior by simply creating an environment
one of the most common application-layer web where attacker can intrudes some malicious code
attacks. It commonly targets script embedded in on to the webpage in order to steal the cookies,
a page which are executed on the client-side (in redirect the user on another website, can do port
the user’s web browser) rather than on the scanning and may also display or steal the
server-side. XSS attack itself is a threat which is content of the database. We also evaluate the
brought about by the internet security attacker’s behavior in order to prevent the
weaknesses of client-side scripting languages, persistent XSS attack.
 IV. CONCLUSION

In this paper we reviewed about the various

types of SQLI attacks. Then we investigated the
strength and weaknesses of the tools used for
protection and detection of SQL injection attack
and its types. We conclude that some tools need
improvement regarding their efficiency and
performance. The tools and techniques used are
limited to prevent and detect only particular type
of SQLI attack not for group of attacks. Some
technique must be developed which detect all
kinds of SQLI attack. After that we discussed
about XSS attack and types of XSS (first order
and second order) attack. We found that second
order XSS attack is more dangerous than first
order attack. In our future work we create
mechanism for finding second order XSS
(persistent XSS attack).

V. REFERNCES

[1] Automatic Creation of SQL Injection and Cross-Site

Scripting Attacks
Adam Kie˙zun (MIT), Philip J. Guo (Stanford University)
Karthick Jayaraman (Syracuse University)
Michael D. Ernst (University of Washington)
[2] Evaluation of SQL Injection Detection and Prevention
Techniques
Atefeh Tajpour and Mohammad JorJor zade Shooshtari
(CASE Center University Technology Malaysia Kuala)
Lumpur, Malaysia
2010 2nd International Conference on Education Technology
and Computer (ICETC)
[3] SQL Injection Detection and Prevention Tools
Assessment
Atefeh Tajpour and Maslin Masrom (CASE Center
University Technology Malaysia Kuala) Lumpur, Malaysia
[4] A solution to block Cross Site Scripting Vulnerabilities
based on Service Oriented Architecture
Jayamsakthi Shanmugam Research Student, BITS, Pilani,
Dr.M.Ponnavaikko, Director of Research and Virtual
Education, SRM University, Chennai
[5] Static Detection of Cross-Site Scripting Vulnerabilities
Gary Wassermann and Zhendong Su (University of
California), Davis