2015 10th International Conference on Broadband and Wireless Computing, Communication and Applications

Static-Based Test Case Dynamic Generation for SQLIVs Detection

Ling Li1, Junxin Qi2,3, Nan Liu1, Lifang Han1, Baojiang Cui2,3
1. China Electric Power Research Institute, Beijing, China
2. School of Computer Science, Beijing University of Posts and Telecommunications, Beijing, China
3. National Engineering Laboratory for Mobile Network Security, China
4. Email: [email protected]

Abstract—We proposed a novel approach to generate test cases which is inseparable from the SQL. SQL injection attacks
for detecting SQLIVs (SQL Injection vulnerabilities), one of (SQLIA) generally use SQL syntax, which makes all
the most foremost threats to Web applications. Dynamic database software based on SQL language standard, such as
testing procedures need to construct an appropriate test to SQL Server, Oracle, MySQL and DB2, are likely to be
launch a simulated attack on the target system, so test case attacked. And SQLIA has nothing to do with Web
generation is a crucial step, which directly affects the efficiency programming language itself, so ASP, JSP, PHP, cannot
of detection. The traditional test case generation technologies completely escape in theory, so the SQLIA is extensive and
have many flaws, for example, blind injection would create a easy to implement. SQL injection vulnerability (SQLIV)
lot of invalid test cases that fail to reach the sink point of
stems from program’s permission for dynamic SQL requests
vulnerability after filtered out. On the other hand, the test
decided by user input. As SQL command is a bridge that
structure far from comprehensive would lead to blind test
spots, giving rise to inefficiency and high false alarm rate.
crosses from the front-end WEB application and the back-
Therefore, we propose to use static analysis results to guide test end database, this vulnerability may enable the attacker to
case dynamic generation. A sequence of injection points and pass in the URL, form, or other input domain to execute
filter missing information of SQL vulnerabilities obtained in arbitrary SQL commands, and thus to the operation of the
the static analysis can be passed as parameters to the dynamic database of the vicious. Once an attack succeeds, any data in
detection module to generate more targeted test parameters. In the database can be manipulated by attackers, who can
order to generate more accurate test set, we parse the test elevate privileges directly in the database and to do
parameters into two parts: the parameter basic structure and everything harmful as a system administrator. Even more
the parameter control information, which will help eliminate a terrorist, the harm can be spread from the database to the
lot of unnecessary redundancy attacks. This kind of joint test operating system and even the whole network.
case generation is just the innovative point of our paper, In recent years, detection work for SQL injection
practically making for more efficient and accurate dynamic vulnerabilities has drawn greater attention. A number of
detection. techniques have been proposed to address SQLIV. These
include input character filtering or input validation [9], static
Keywords-test case generation; static analysis; SQLIVs; analysis [11] , runtime monitoring [12], combination of static
dynamic detection and runtime monitoring [4], automatic fixing of source code
[2], etc. Increasingly, automated detection tools are being
I. INTRODUCTION used to identify SQL Injection vulnerabilities. Many of these
In this Internet+ era, as the web applications becoming tools are designed with the technique of program testing,
more and more complicated on user experience, the security such as the famous Saner[3], AMNEsIA[4] and JCrasher[5].
problem of network grows. We are witnessing an increase in Saner first carries out static analysis on control flow and data
the number and sophistication of attacks that target them. flow of the entire system to look for the injection points,
Many web-based applications need to use a private derivation points and sink points, and then summarizes
document to store sensitive data which can be accessed by filtering process through pollution paths. During the next
network. Many greedy hackers try to utilize a variety of dynamic detection procedure, Saner constructs test cases for
attacks methods by all means to obtain these sensitive data. high-risk injection points making use of information
In particular, SQLIVs(SQL injection vulnerabilities) in obtained from static analysis to simulate user inputs.
which specially crafted input strings result in illegal queries AMNEsIA creates SQL query mode for each access points to
to a database, has become one of the most foremost threats to database in the program, monitors SQL statements
Web applications. dynamically generated by the process, and compares with the
Because anyone including the internal users and external query mode of this point to explore SQL injection
users, even the administrator, can use information systems to vulnerabilities. JCrasher analyzes the type information of
transfer incredible data, injection vulnerability is most Java classes and code structures, uses the trajectory analysis
common in the Web security risks. SQL (Structured Query method to determine the space of function parameters, builds
Language) is a standard database manipulation Language. various types of test cases based on random data, and
Today's information systems are supported by database,

978-1-4673-8315-8/15 $31.00 © 2015 IEEE 173

DOI 10.1109/BWCCA.2015.59
Authorized licensed use limited to: University of Technology Sydney. Downloaded on September 24,2024 at 07:13:17 UTC from IEEE Xplore. Restrictions apply.
simulates user inputs that cause an exception in the program ignored by the database engine (as it is comment symbol).
to detect flaws. The syntax of the altered query is correct. Therefore, the
Our study focuses on the generation of test cases, which attacker will be able to skip the authentication after the query
is a crucial step that provides dynamic validation with the is executed and assume the identity of the first user of the
data base. On one hand, parameters evolve variously not table members. Halfond et al. classify SQLIAs into seven
only with program’s uncertain execution, but also in case of categories. They are tautologies, union queries,
the same function, so blind exhaustive creation of test cases illegal/logical incorrect queries, piggybacked queries, stored
is very inefficient and has low coverage. On the other hand, procedures, inference attacks, and alternate encodings (or
most programs have a certain degree of filtering on user Hex encoded queries) [6].
input or use parameterized statements to prevent SQL
injection. So in order to avoid the test cases filtered out 1. String LoginAction (HttpServletRequest request, …)
before arriving at executive function, restricted information throws IOException{
of parameters must be taken into consideration. In this paper, 2. String sUser = getParameter(request, “Username”);
we take advantage of static analysis results to guide dynamic
test case generation, combining the parameter base structure 3. String sPassword = getParameter(request,
with control information to generate a structured set of test “Password”);
cases.
4. java.sql.ResultSet rs = null;
The rest of this paper is organized as follows. In section 2,
we introduce the SQL injection and automated test case 5. String query = “select id, level from members where ”;
generation technique, and explain the concept of SQL 6. query = query + “username=’”+sUser+
injection point, which is closely related to SQL injection
vulnerabilities in the program. In section 3, some crucial “’ and password =’”+sPassword+”’”;
technical methods used to generate test cases are given. In 7. java.sql.ResultSet rs = statement.executeQuery(query);
section 4, the overall framework of static-based test case 8. if(rs.next()) // username and password passed
dynamic generation technique is presented, and we expound
the process in detail. Section 5 presents our empirical 9. session.setAttribute(“UserID”, rs.getString(1));
evaluation and, finally, we conclude and outline future work …
in Section 6. }
II. BACKGROUND
Figure 1. Code snippet for an example of SQLIVs written in Java
A. SQL injection SQL injection point, the entry of the SQL injection, is a
SQL injection vulnerabilities (SQILVs) stem from the function statement for interacting with background database,
lack of input validation. Web applications accept malicious where attack statements enter into the program execution. To
input without properly checked or strict filter the input detect SQL injection vulnerabilities, we first need to get SQL
values prior to their use, which can lead to illegal access to injection points in the program that set limits on parameters
the database. to structure test cases. Web communication protocol is based
In many cases, SQL queries are dynamically constructed on HTTP protocol. The main ways that users submit data to
via user input. Despite there being several safer ways to the application are GET, POST, COOKIE, and HTTP
make SQL queries in systems such as using headers[7]. Different request modes have their separate
PreparedStatement, queries are often dynamically generated limits for the data length and format, which will be
in string concatenations, an unsafe and poor programming considered in the parameter control information to guide the
practice. We provide an example of an SQLIA by using the test case generation.
ode snippet of server side application shown in Figure 1.
Line 2 and 3 extract user supplied information from B. Test case generation
Username and Password field into sUser and sPassword Dynamic testing procedures need to construct an
variables, respectively. The user input is not filtered and a appropriate test to launch a simulated attack on the target
dynamic SQL query is generated in Line 5 and 6. Let us system. Sufficient test cases can make the test more effective,
assume that a user provides valid username and password, but redundant test cases can bring false positives. So , the
which are “guest” and “secret”, respectively. Then, the generation of test cases is very important to the accuracy and
generated query at Line 6 becomes “select id, level from efficiency of SQLIV testing. However, most of the studies
members where username =’guest’ and password on the test of SOLIVs focus on the information gathering
= ’secret’”. The database engine executes the query at Line 7 and feedback information analysis processes, but pay little
and the user is authenticated with valid UserID at Line 9. A attention to the test case generation technique. Traditional
malicious user might supply input “’ or 1=1 -- ” in the first test case generation technologies have many flaws. For
field and leave the second input field as blank. The resultant example, a lot of enumeration test cases fail to reach the sink
query will be “select id, level from members where username point of vulnerability after filtered out. On the other hand,
=’’ or 1=1 --’ and password =’’”. The resultant query is a the test structure far from comprehensive would lead to blind
tautology as the query portion after the symbol “--” will be test spots, giving rise to inefficiency and high false alarm

174

Authorized licensed use limited to: University of Technology Sydney. Downloaded on September 24,2024 at 07:13:17 UTC from IEEE Xplore. Restrictions apply.
rate. In recent years, although a few researches have been performance of the whole system. Parameter control
carried on the approaches of test cases generation for information including vulnerability location, replacement
detecting SQLIV[15,16,17,18,19], the results are still license, variable rule, filter omission, response analysis. We
insufficient. record these elements into the control file according to the
combination rules, and read them when parameters are
III. TECHNIQUE automatically generated. Figure 2 presents the composition
We parse the constructed test case model into two parts of parameter control information.
that is parameter basic structure and parameter control • Vulnerability location the positions in the code that
information. In order to generate more accurate test cases, can be injected, may exist in the Url, Form, cookies,
the parameter control information will be parsed into and HTTP headers, etc.
multiple elements, including replacement license, • Replacement license represents if there are some
vulnerability location, variable rule, filter omission, elements in parameters can be replaced or not.
response analysis, which later we will give in details • Variable rule evolution rules of SQL injection
parameters, numbers or strings, length limit, and
A. Parse parameter basic structure coding transformation, etc.
Before construction, we must particularly analysis the • Filter omission omissions of input filter obtained
basic structure of SQL parameters, the body of test cases, from static analysis, such as data type, data length,
which are actually a fragment in a series of SQL statements. data format, etc.
Random construction directly to the entire SQL statement • Response analysis summarization and analysis
can be blind and inefficient. So we resolve the test cases about the server’s feedback after receiving the data
structure to multiple elements, including variable element for results.
user input. In accordance with the scheduled rules, we create
test cases formed by these elements.

Figure 3. The parameter basic structure of test case

In order to construct more accurate test cases, we must

Figure 2. The parameter basic structure of test case make full use of the parameter control information which
obtained from formatted static analysis results according to
As Figure 1 shows, the parameter basic structure is the above mentioned elements combination. The system later
composed of the following six elements: prefix endpoint loads each element in a certain order to guide the generation
(PreEnd), prefix of the parameters (Prefix), SQL keyword procedure of test cases.
(keyword), constants and variables (ParN), suffix of the
parameters (suffix), suffix endpoint (sufEnd). PreEnd IV. PROPOSED SYSTEM
semantically separates SQL statements usually by quotation In this paper, we take advantage of static analysis results
marks to insure them not affected by each other. Prefix is to guide dynamic test case generation, combining the
used to adjust the SQL statement front logic usually by "or" parameter base structure with control information to generate
or "and". Keyword is extremely important that marks the a structured set of test cases. Figure 3 shows the overall
function of this SQL statement. For example, "select" means framework of our proposed Static-Based Test Case Dynamic
query, and "union" means joint. ParN is a variable element Generation for SQLIVs.
which we change according to the environment parameters First, the system starts from the static analysis to collect
and combine with others according to certain rules, in order loopholes node position and filtering omissions, loading
to obtain a large number of test cases. Suffix, complement to WEB application source code.
Prefix, limits the scope and conditions of the SQL statement Second, these analysis results will be unified format to
that can be a symbol or conditional. SufEnd, opposite to normative analysis ones that will passed to dynamic
PreEnd, located right at the end of the SQL statement, and generation module. Later, the system obtains the source code
usually composed of annotation symbols so that subsequent segment of injection points, parse the parameters into
SQL statements will be commented out to work to ensure the formatted SQL statements, and deposit them in the XML
successful realization of the one at present, marks the closure document.
and boundary. Next, On the basis of parameter control information, we
B. Combine parameter control information configure replaceable element to preliminary generate test
parameters. At this point, the vulnerability location is loaded
Parameter control information is a collection of the in parameter control information to get the location of the
limitation elements on the parameters, relating to the vulnerabilities exist (these locations are obtained in the
generation accuracy and efficiency, and even the process of preliminary static analysis). Combined with

175

Authorized licensed use limited to: University of Technology Sydney. Downloaded on September 24,2024 at 07:13:17 UTC from IEEE Xplore. Restrictions apply.
filtering missing information, preliminary tentative injection
data are constructed, prepared for the final test cases
generated. Generated data are designed for the filter
omissions, such as developers’ negligence on the length of
the user input validation when coding which will be included
in filter omission. After the initial test cases generated, the
system sends the injection request to the server and performs
simulate injection operation.
Then, according to the application response, we can
determine whether the server is affected by the initial test
cases. If not, return again read holes location information and
filter the missing information, the system returns to

vulnerability location information and constructs new
Figure 5. Reading process for parameter control information file
parameter to try again, until form a substantial attack on the
target system.
Finally, according to these successful injection inputs, we V. EVALUATION
create a batch of structured test cases on the basis of variable
rules within bounds. To demonstrate the supposed effectiveness of this
method, we applied our technique to three Struts-based web
applications [8] from the open-source repository Sourceforge
and each of them depends on a database backend with
different kinds of SQL injection vulnerabilities. Details are
listed in Table I . The third column (URL Sequences) lists
the number of URLs in the applications that are not repeated,
as injection points. The fourth column (Ends in SQL sink)
lists the number of SQL sink functions that user input can
reach through mentioned URLs. We focus on one injection
point (namely one URL) for each application to generate test
cases. As the results present in Table II, our method shows
higher accuracy than blind exhaustive method that the
majority of our test cases can reach the sink functions and
trigger the vulnerabilities.

TABLE I. APPLICATION DETAILS

Application Description URL Ends in
Sequences SQL sink
PersonalBlog Blogging software 15 2
JOrganizer Address book 356,358 260
JGossip Forum system 1,062,539 16031

TABLE II. EXPERIMENTAL RESULTS

Application Our technique Blind creation
total reach sink total reach sink
PersonalBlog 50 41 50 16
JOrganizer 50 29 50 5
JGossip 50 32 50 7

VI. CONCLUSION
SQL injection vulnerability is one of the most foremost
threats to Web applications which perform critical missions
and handle sensitive information. Attacks that exploit such
Figure 4. Static-based test case dynamic generation technique framework type of vulnerabilities increase rapidly over time. Automated
for SQLIVs testing techniques are important, not only to detect
vulnerabilities in web services before they can be published,
Reading elements in parameter control file should be in a but also to reduce testing effort in contexts where the
certain order. Figure 4 shows the reading process in details. numbers of services and their input parameters are large.
Dynamic detection of the source code has been proved to be
a kind of effective preventive measure. As a crucial step, the
generation of test cases relates to the efficiency and

176

Authorized licensed use limited to: University of Technology Sydney. Downloaded on September 24,2024 at 07:13:17 UTC from IEEE Xplore. Restrictions apply.
performance of the whole detection system. However, little International Symposium on Secure Software Engineering (ISSSE
research on test case generation has considered the 2006),Arlington, Virginia, Mar. 2006.
sanitization process performed by the applications to prevent [6] Halfond W G J, Orso A, Manolios P. Using positive tainting and
syntax-aware evaluation to counter SQL injection attacks[J]. Sigsoft
potential malicious inputs, leading to a lot of invalid cases. Fse, 2006:175--185.
In this paper, we have presented a novel approach to the [7] Martin M, Lam M S. Automatic Generation Of Xss And Sql Injection
test case generation for detecting SQL vulnerabilities. The Attacks With Goal-Directed Model Checking[J]. Usenix Security,
approach takes advantages of a sequence of injection points 2008.
and their filter omissions, obtained from the static analysis [8] Michael Howard and David C. LeBlanc, “WritingSecure Code”,
and passed as parameters to the dynamic detection module, Second Edition, Microsoft Press, 2002.
to generate more targeted test cases. We parse the test [9] Michael Emmi , Rupak Majumdar , Koushik Sen, Dynamic test input
parameters into two parts: the parameter basic structure and generation for database applications, Proceedings of the 2007
the parameter control information, which will help eliminate international symposium on Software testing and analysis, July 09-12,
2007, London, United Kingdom
a lot of ineffective test cases. We have implemented our
[10] Z. Su and G. Wasserman, “The Essence of Command Injection
approach to show that this kind of joint test case generation Attacks in Web Applications”, In Proceedings of Symposium on
practically makes for more efficient and accurate dynamic Principles of Programming Languages POPL’06, Jan 2006, South
detection. In our future work, we will further refine our test Carolina, USA, pp. 372-382.
case model and enrich the parameter control information to [11] Buehrer G T, Weide B W, Sivilotti P A G. Using parse tree validation
get more accurate constraint conditions. to prevent SQL injection attacks[J]. Proceedings of the International
Workshop on Software Engineering & Middleware at Joint Fse &
ACKNOWLEDGMENT Esec, 2005:106--113.
[12] Yuetang Deng , Phyllis Frankl , David Chays, Testing database
This work was supported by National Natural Science transactions with AGENDA, Proceedings of the 27th international
Foundation of China( No.61272493). conference on Software engineering, May 15-21, 2005, St. Louis,
MO, USA
[13] Myra B. Cohen , Peter B. Gibbons , Warwick B. Mugridge , Charles
REFERENCES J. Colbourn, Constructing test suites for interaction testing,
Proceedings of the 25th International Conference on Software
[1] Anley C, Anley C. Advanced SQL Injection in SQL Server
Engineering, May 03-10, 2003, Portland, Oregon
Applications[J]. Insight Security Research .chris Anley.advanced Sql
Injection in Sql Server Application, 2002. [14] Visser W, Psreanu C S, Khurshid S. Test Input Generation with
Java PathFinder[J]. Proceedings of Issta, 2004, 29(4):97-107.
[2] Thomas S, Williams L. Using Automated Fix Generation to Secure
SQL Statements[C]// Software Engineering for Secure Systems, [15] Y. Shin, L. Williams, T. Xie, “SQLUnitgen: Test case generation for
2007. SESS '07: ICSE Workshops 2007. Third International SQL injection detection,” North Carolina State University, Raleigh
Workshop on. IEEE, 2007:9. Technical report (NCSU CSC TR), Vol. 21, 2006.
[3] Balzarotti D, Cova M, Felmetsger V, et al. Saner: Composing Static [16] J. Wang, R. C. W. Phan, J. N. Whitley, D. J. Parish, “Augmented
and Dynamic Analysis to Validate Sanitization in Web attack tree modeling of SQL injection attacks,” Information
Applications[C]// Security and Privacy, 2008. SP 2008. IEEE Management and Engineering (ICIME), IEEE, 2010: 182-186.
Symposium on. IEEE, 2008:387-401. W. Halfond and A. Orso. [17] A. Marback, H. Do, K. He, S. Kondamarri, D. Xu, “Security test
AMNESIA: Analysis and Monitoring for NEutralizing SQL-Injection generation using threat trees,” Automation of Software Test (AST
Attacks. In International Conference on Automated Software 09), ICSE Workshop on IEEE, 2009: 62-99.
Engineering (ASE), pages 174-183, November 2005. [18] Liu L, Xu J, Li M, et al. A Dynamic SQL Injection Vulnerability Test
[4] Csallner C, Smaragdakis Y. JCrasher: an automatic robustness tester Case Generation Model Based on the Multiple Phases Detection
for Java[J]. Software—practice & Experience, 2004, 34(11):2004. Approach[C]// 2013 IEEE 37th Annual Computer Software and
[5] Gould W. G. Halfond, J. Viegas, and A. Orso, “A Classification of Applications ConferenceIEEE Computer Society, 2013:256-261.
SQL-Injection Attacks and Countermeasures”, In Proceedings of the

177

Authorized licensed use limited to: University of Technology Sydney. Downloaded on September 24,2024 at 07:13:17 UTC from IEEE Xplore. Restrictions apply.