XploitSQL: Advancing Adversarial SQL Injection Attack

Generation with Language Models and Reinforcement Learning

Daniel Leung Omar Tsai Kourosh Hashemi
Simon Fraser University Simon Fraser University Simon Fraser University
School of Computing Science School of Computing Science School of Computing Science
Burnaby, British Columbia, Canada Burnaby, British Columbia, Canada Burnaby, British Columbia, Canada
[email protected] [email protected] [email protected]

Bardia Tayebi Mohammad A. Tayebi

University of Isfahan Simon Fraser University
School of Computing Science School of Computing Science
Isfahan, Iran Burnaby, British Columbia, Canada
[email protected] [email protected]

Abstract Keywords
SQL injection (SQLi) compromises database-driven applications Database security, SQL injection, Language models, Reinforcement
by enabling attackers to insert malicious SQL commands via input learning
fields, potentially leading to unauthorized access, data manipula-
tion, or system compromise. In recent years, alongside the devel- ACM Reference Format:
Daniel Leung, Omar Tsai, Kourosh Hashemi, Bardia Tayebi, and Mohammad
opment of various rule-based Web Application Firewalls (WAFs)
A. Tayebi. 2024. XploitSQL: Advancing Adversarial SQL Injection Attack
aimed at mitigating SQL injection attacks, there has also been a Generation with Language Models and Reinforcement Learning. In Proceed-
notable rise in the utilization of machine learning and deep learning ings of the 33rd ACM International Conference on Information and Knowledge
techniques to address this issue. Although significant progress has Management (CIKM ’24), October 21–25, 2024, Boise, ID, USA. ACM, New
been made in these studies, detecting and mitigating SQLi-related York, NY, USA, 8 pages. https://doi.org/10.1145/3627673.3680102
attacks continues to present a significant challenge. A crucial factor
contributing to the lack of extensive SQLi detection solutions is
the absence of a comprehensive testing methodology. In this work, 1 Introduction
we introduce XploitSQL—an innovative approach to advance ad- SQL injection (SQLi) attacks are a significant security threat to
versarial SQL injection generation by leveraging language models web applications that use SQL for database management. By ex-
and reinforcement learning. Our model is trained to produce eva- ploiting input validation flaws, attackers can inject malicious SQL
sive SQLi samples, enhancing the robustness of SQLi detection commands, potentially leading to data breaches or system control.
models and offering opportunities for more comprehensive detec- SQLi is one of the oldest vulnerabilities and has remained in the
tion strategies. To assess the efficacy of the proposed method, we OWASP Top 10 for over twenty years [2]. In 2023 alone, 2,159 SQL
employed state-of-the-art SQL injection detection models in con- injection vulnerabilities were reported and assigned CVE identifiers
junction with commercially available web-based firewalls. Across [3].
all tested detection models, detection rates declined when faced Preventing SQLi attacks is vital for safeguarding web and data
with evasive samples generated by XploitSQL. Furthermore, our security. SQLi detection strategies generally fall into two cate-
model outperforms existing methods for generating attack samples. gories: rule-based [15, 29] and machine learning (ML) approaches
[14, 18, 19]. Traditionally, Web Application Firewalls (WAFs) [6, 20]
CCS Concepts used in detecting SQLi attacks heavily rely on predefined detec-
tion rules employing semantic analysis. However, the adaptable
• Security and privacy → Database and storage security; Data-
nature of SQL syntax presents challenges in covering all potential
base activity monitoring; • Computing methodologies → Natural
SQLi scenarios, leading to diminished detection efficacy [28]. To
language processing.
address this, researchers increasingly explore machine learning
techniques [14, 17, 18] for SQLi detection. These methods typically
entail converting queries into word vectors and extracting consec-
Permission to make digital or hard copies of all or part of this work for personal or
classroom use is granted without fee provided that copies are not made or distributed utive characters as features to identify malicious queries. Despite
for profit or commercial advantage and that copies bear this notice and the full citation notable progress, these approaches are still susceptible to attacks,
on the first page. Copyrights for components of this work owned by others than the posing a significant challenge that warrants further attention.
author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or
republish, to post on servers or to redistribute to lists, requires prior specific permission One of the primary causes of failure in SQLi detection models
and/or a fee. Request permissions from [email protected]. is the absence of thorough testing before deploying such solutions
CIKM ’24, October 21–25, 2024, Boise, ID, USA [7]. Implementing a rigorous testing approach enables developers
© 2024 Copyright held by the owner/author(s). Publication rights licensed to ACM.
ACM ISBN 979-8-4007-0436-9/24/10 of detection models to gain deeper insights into the weaknesses of
https://doi.org/10.1145/3627673.3680102 their solutions and effectively address them.

4653
CIKM ’24, October 21–25, 2024, Boise, ID, USA Daniel Leung, Omar Tsai, Kourosh Hashemi, Bardia Tayebi, and Mohammad A. Tayebi

The purpose of red teaming [10] in cybersecurity is to proac- SQL injection, where the attacker uses the same communication
tively simulate real-world attacks, aiming to pinpoint vulnerabil- channel for both injecting SQL code and retrieving data. Secondly,
ities, evaluate defense solutions, and enhance an organization’s out-of-band SQL Injection involves using a different channel to
overall security posture. Inspired by red teaming methodologies, extract data from the database, separate from the injection channel.
we introduce XploitSQL a novel and efficient approach to gen- This could include techniques like DNS or HTTP-based data re-
erate SQL injection attacks. XploitSQL utilizes language models trieval. Lastly, inferential SQL Injection doesn’t directly reveal the
and reinforcement learning to make this process more effective. result of the SQL injection in the application’s response. Instead,
Through iterative refinement and interaction with the target de- the attacker infers the success or failure of their SQL query based
tection model, XploitSQL demonstrates an enhanced capability on differences in the application’s behavior.
to generate increasingly evasive SQLi samples, effectively evading The primary responsibility for ensuring input data validation and
detection mechanisms. code vulnerability analysis falls on application developers. How-
Our proposed model begins with training a language model ever, considering real-world experiences, even following secure
specialized in generating SQL queries, establishing the foundation. programming best practices, vulnerabilities can still emerge. This
Subsequently, reinforcement learning is introduced through an emphasizes the importance of an additional layer of protection.
actor-critic setup, where the pre-trained language model serves as WAFs serve as critical defense mechanisms by conducting thor-
both actor and critic. Following the completion of reinforcement ough packet inspections on network traffic between clients and
learning training, we preserve the actor model and discard the critic servers. By analyzing the exchanged data, WAFs can detect poten-
model. A carefully crafted reward function motivates the actor tial attacks, including SQLi, that may have slipped through during
model to produce SQL queries that meet syntactic correctness and implementation. The subsequent section will delve into this topic.
perform optimally in predefined evaluation metrics for attacking a
target SQLi detection model.
Extensively evaluated across diverse detection systems and in 2.2 Web Application Firewall
comparison with the baseline models, XploitSQL demonstrates Web Application Firewalls (WAFs) are essential defenders of en-
remarkable efficacy in most of the test scenarios. The experimental terprise web systems, shielding them from malicious attacks. Op-
results not only highlight a significant decrease in the performance erating as a protective barrier around the web applications they
of both WAF and ML-based SQLi detection models but also show safeguard, WAFs analyze incoming HTTP messages to discern
that our model outperforms the baseline models. The SQL injec- whether they should be permitted to reach the intended destination
tion (SQLi) detection rate for the evaluated methods significantly or blocked. This decision-making process relies on a set of rules
decreases by up to 47% when using adversarial samples generated designed to identify and intercept potential attack patterns, thus
by XploitSQL. Our model either surpasses or achieves the same ensuring the robust security and integrity of the entire web infras-
performance as baseline models in five out of six detection models tructure. WAFs come in various forms: signature-based, ML-driven,
which shows the robustness XploitSQL in generating adversarial or hybrid, which leverage the strengths of both approaches.
SQLi samples. Signature-based WAFs protect applications only based on pre-
In summary, our contributions are as follows: defined attack signatures. These signatures are patterns or rules
• We propose a methodology leveraging the capabilities of derived from known threats. However, signature-based WAFs can
LLMs (Large Language Models) and RL (Reinforcement Learn- become increasingly complex over time, necessitating advanced
ing) to generate targeted evasive SQL injections. expertise to update as new attacks emerge. Their reliance on human
• To ensure the effectiveness of the generated attack sam- intervention introduces potential vulnerabilities, such as implemen-
ples, we test them against state-of-the-art machine learning- tation bugs and configuration errors. Without careful management,
driven models and WAFs developed by major vendors. they are prone to high rates of false positives and false negatives.
• To ensure the comprehensiveness of our methodology, we Contrary to signature-based WAFs, ML-driven WAFs capitalize
compared the model with baselines to assess its performance. on extensive datasets of both legitimate and malicious traffic to
In this paper, Section 2 provides an overview of related work. extract meaningful patterns. This iterative process enables them to
Section 3 introduces the background and problem statement. Sec- continually enhance their understanding of evolving attack vectors.
tion 4 details our proposed approach for generating adversarial SQL Appelt et al. [5] propose a hybrid method merging machine
injection samples. Section 5 analyzes and discusses the experimen- learning and evolutionary algorithms to autonomously evaluate
tal results. Section 6 explores further applications of the proposed WAFs’ attack detection capabilities. This method generates a di-
model, while Section 7 offers concluding remarks for the paper. verse array of attacks, assesses their identification by the WAF,
and adapts based on results. By learning from both blocked and
2 Background and Related Work bypassed tests, this method prioritizes tests with patterns likely
to bypass the firewall. Ito et al. [13] employ a character-level Con-
2.1 Exploiting SQL Injection volutional Neural Network with extensive global max-pooling to
SQL injection is a type of code-injection attack that exploits vulner- extract features from HTTP requests and classify them as normal or
abilities by manipulating user input, causing the system to interpret malicious. Betarte et al.’s [8] approach addresses various scenarios
it as SQL code. This manipulation can result in unauthorized access based on data availability and offers two solutions: a multi-class
to databases. SQL injection can be categorized into three distinct approach for scenarios with both legitimate and malicious data,
types. Firstly, there’s in-band SQL Injection, also known as classic and a one-class solution for scenarios with only legitimate data.

4654
XploitSQL: SQL Injection with Language Models and Reinforcement Learning CIKM ’24, October 21–25, 2024, Boise, ID, USA

2.3 Evading SQLi Detection Models (𝑦 = 1). We assume a black-box attack scenario, where the model
The focus of this research domain is primarily on developing de- has no access to the detection system’s internal workings but can
fense solutions rather than attack methods, driven by the pressing observe its output indicating whether a query is flagged as benign
need to protect systems from evolving threats. However, signifi- or malicious. The goal is to produce SQL injection queries that
cant work is also dedicated to demonstrating the weaknesses of are malicious but are incorrectly classified as benign by the SQLi
detection systems designed for various vulnerabilities, leading to detection system. As the starting point of this problem space, a
the development of more ML-driven open-source solutions. Xu et set of SQL injection queries that the detection system identifies
al. introduced a technique using a genetic algorithm to generate as malicious is given. The challenge for an adversary is that, for a
adversarial examples that can evade PDF malware classifiers [27]. given test query 𝑥, to produce a modified query 𝑥 gen that evades
Anderson et al. proposed a model to bypass various malware detec- detection and is classified as benign by the detection system.
tion systems by modifying malware samples through semantically In a black-box setup, the attacker’s efforts are limited to the
invariant transformations, relying solely on the score provided by testing phase without access to the internal architecture of the
the victim classifier [4]. When attackers lack direct access to a spe- target SQLi detector. Essentially, the attacker can only input data
cific system but have some knowledge of it, the authors suggest and observe the resulting output, without any further access or
training a substitute model to simulate the target system. Several insight. Despite these limitations, attackers can still manipulate
studies fall into this category, crafting attacks across different do- database requests, potentially modifying or accessing sensitive data
mains [9, 12, 16, 24]. or causing irreversible damage to databases. Moreover, executing
Regarding SQLi, malicious actors continuously evolve their tech- SQLi attacks does not require advanced hacking skills, as many
niques to create more sophisticated and evasive samples, exploiting free or commercially available tools are readily available online.
weaknesses in ML-driven or signature-based WAFs. They use meth- With some practice, attackers can also develop their own scripts to
ods such as obfuscation and mutation to alter the structure and exploit SQLi vulnerabilities effectively.
appearance of attacks, bypassing signature detection. Additionally,
they employ adversarial machine learning to craft inputs specifi- 4 Methodology
cally designed to evade ML models, exploit model overfitting, and Our proposed approach for SQLi attack sample generation, Xploit-
iteratively refine their techniques based on WAF responses. By SQL, utilizes a hybrid technique by combining large language mod-
mimicking legitimate queries and using a variety of encoding meth- els with reinforcement learning, as illustrated in Figure 4. Initially,
ods, attackers ensure their malicious activities remain undetected, a language model is trained to generate SQL queries, serving as
constantly staying ahead of security measures. the foundational model. Following the training of an initial lan-
Our proposed solution, XploitSQL aligns with two recently pro- guage model, reinforcement learning is introduced into the archi-
posed models designed to evade SQLi detection systems, WAF-A- tecture—following an actor-critic method. Here, the pre-trained
MoLE [25] and AdvSQLi [21]. WAF-A-MoLE uses guided mutation language model acts as both the actor and the critic. Once training
fuzzing to lower the confidence scores of the classifier. In each mu- is completed using reinforcement learning, the actor model is then
tation cycle, the mutant with the lowest confidence score is selected preserved while the critic model is discarded. The reward func-
as the basis for the next cycle. However, this approach is less effec- tion is carefully designed to incentivize the actor model towards
tive against detection since the final result follows a straightforward generating SQL queries that not only adhere to syntactic correct-
path through a mutation tree. AdvSQLi [21] is a weighted mutation ness but also show optimal performance according to the specified
strategy based on context-free grammar to generate an extensive evaluation metrics.
array of equivalent SQLi payloads. It leverages the Monte-Carlo
tree search to efficiently select the adversarial payload from this
4.1 Pre-trained Language Model
extensive space. XploitSQL, as elaborated in Section 4, tackles
the same problem addressed by WAF-A-MoLE and AdvSQLi, but it Modern LLMs, predominantly based on the transformer architec-
takes a different approach. Our experimental evaluations show that ture [26] features a self-attention block, a pivotal innovation dis-
XploitSQL outperforms the other two comparable models across tinguishing them from prior NLP models. This block computes a
the majority of cases. weighted average of the input sequence, enabling the model to
focus on specific elements rather than merely the next character.
By leveraging this capability, transformers can discern crucial parts
3 Problem Statement of the input sequence, resulting in improved performance across
We approach the SQLi attack generation problem through an adver- various NLP tasks.
sarial lens. In the realm of cybersecurity, it’s essential to perceive LLMs, when fine-tuned for specific tasks, demonstrate excep-
challenges from this standpoint and enhance defensive strategies tional performance. This not only significantly reduces the time
based on weaknesses discovered in this process. This process, of- and effort required to train and develop language models from
ten termed red teaming versus blue teaming, focuses on defending scratch but also enhances their effectiveness for targeted tasks. One
against the red team’s attacks. prominent example of such an LLM is the Text-to-Text Transfer
Given an SQLi detection system, the primary objective of an Transformer (T5) model [23]. This model operates on a similar
adversary is to develop a model capable of generating SQL injection principle to the original transformer model, featuring an encoder-
queries that bypass the detection system. The detection system decoder architecture pre-trained through unsupervised learning.
classifies queries into two categories: benign (𝑦 = 0) and malicious It operates by providing data in a text-to-text format to the model,

4655
CIKM ’24, October 21–25, 2024, Boise, ID, USA Daniel Leung, Omar Tsai, Kourosh Hashemi, Bardia Tayebi, and Mohammad A. Tayebi

Is valid SQL?

Original
Is SQL injection?
query
SQL Injection
LLM Model
query
Evades detection?
Transformed
query Reward
Actor Query similarity

Critic

Figure 1: Workflow of LLM and RL models in training XploitSQL

prompting it to generate output text corresponding to the input action space—making the language model prioritize more important
text. Additionally, since the dataset comprises web-extracted text, tokens. For example, SQL tokens such as SELECT, FROM, WHERE and
this enables the model to learn across a broad spectrum of tasks. JOIN are prioritized, while rare or special tokens are masked out as
As the starting point for creating a refined SQL injection sample, they are less likely to appear in typical queries. The emphasis on
XploitSQL uses a T5 model that is pre-trained for generating SQL more relevant SQL tokens leads us to a model that generates more
queries. The rationale behind this choice lies in the fact that this accurate and contextually appropriate queries.
model is already trained for generating SQL queries. By fine-tuning To enhance the employed LLM for generating increasingly eva-
it further, we can steer its focus towards generating SQL injection sive SQLi samples, we integrate reinforcement learning techniques.
queries, which represent a more specialized type of SQL query. This Our primary objective is to evade the detection model, and for this
approach not only conserves computational resources compared to purpose, we utilize an actor-critic framework. In this framework,
training a base model from scratch but also promises performance both the actor and the critic are based on the same LLM, albeit as
enhancements for our final model. two distinct copies of the base LLM model. The actor is tasked with
For a language model, prompt tuning is a pivotal factor influ- learning the structure of SQLi and generating queries that evade
encing model performance. Within our training methodology, we the target SQLi detection model. Meanwhile, the critic evaluates the
thoroughly explore a multitude of potential keywords and sentences generated queries using the reward function defined in Section 4.3.
capable of enhancing the model’s proficiency in generating high- This evaluation includes assessing whether the queries bypass the
quality samples. Subsequently, the model is subjected to a spectrum target SQLi detection model, thereby facilitating a reinforcement
of novel prompts derived from these elements. The queries gen- learning feedback loop that promotes the generation of appropriate
erated in response undergo a thorough evaluation, allowing us to evasive SQLi samples.
discern which keywords and phrases yield superior outcomes. This This fine-tuning process is iterative, wherein the model is pro-
iterative refinement process contributes significantly to optimizing vided with queries generated in its previous iteration. This setup
model performance. enables the model to learn from its mistakes and improve over time.
Initially, in the first iteration, only the values from the dataset are
utilized, as there are no previous model-generated outputs available.
4.2 Fine-tuning with RL However, starting from the second iteration onwards, the model
Using RL for LLM-based generation poses practical challenges, begins to leverage the generated outputs from the previous itera-
notably training instability arising from the vast combination of tion for training. This is achieved by having the model from the
possible actions. This issue is addressed in [22], which introduces a last iteration produce a new set of queries based on the training
performant RL algorithm named NLPO. XploitSQL also employs dataset. Subsequently, this set of new queries is evaluated and uti-
NLPO to improve SQL injection queries generated by the T5 model. lized as the training dataset for the next iteration. Additionally, to
Through top-p sampling, NLPO learns to mask out less relevant provide the model with references to the original dataset, not just
tokens during training, thereby reducing the action space and en- the generated queries from the last iteration, 10% of the original set
hancing stability. By periodically updating masking on the current is also included in the input of each round of iterations.
policy, NLPO balances task relevance and training efficiency.
To fine-tune the language model with RL, XploitSQL focuses on
recognizing relevant tokens and filtering out non-relevant tokens. 4.3 Reward Model Training
In this process, keywords and commonly used identifiers are kept To assess if the generated query effectively evades the detection
while less essential ones are dropped. This effectively reduces our model, we incorporate a reward model to evaluate its performance.

4656
XploitSQL: SQL Injection with Language Models and Reinforcement Learning CIKM ’24, October 21–25, 2024, Boise, ID, USA

This model assigns a score to the query, which then serves as a and sentiment analysis. These models preprocess text data and
reward for refining LLM through the RL learning process. The convert it into numerical features using techniques like TF-IDF or
following are four metrics we use in this process. word embeddings. Similar solutions can be used for SQLi detection
⋄ Validity measure. This metric evaluates whether the generated [11, 18].
query is a valid SQL query or not. It’s distinct from checking In our experimental results, we employ two machine learning
whether the query is an SQL injection attempt because it’s plausi- models, CNN and LSTM, as SQLi detection models. To evaluate
ble for the generated query to be synthetically invalid but bypass the real-world efficacy of our proposed model, we use four WAFs
a SQLi detection model. from major vendors, including Amazon Web Services (AWS), F5
⋄ Injection measure. This metric evaluates whether the generated and the cutting-edge open-source WAF, ModSecurity. All of these
query is an SQLi attempt. Employing this approach enables tiered SQLi detection models have demonstrated strong performance in
rewards based on multiple metrics, rather than a binary reward classifying malicious and benign SQLi samples, and we aim to assess
system, facilitating more effective learning. Note that not all SQLi their resilience in detecting adversarial samples generated by our
queries can bypass the detection model. proposed model and tested baseline models.
⋄ Evasion measure. This metric ensures evasion capability, em- Baseline Models. Baseline methods include approaches in the
ployed both independently and in conjunction with the two pre- literature aimed at generating evasive SQLi samples, against which
ceding metrics. Their collective assessment forms the base-tier we compare our proposed method, as introduced below:
reward, further augmented by the final metric. • WAF-A-MoLE. This model leverages query mutation to generate
⋄ Similarity measure. This measures query likeness between the evasive SQLi samples [25].
input and generated queries. Unlike prior metrics, it’s not binary • AdvSQLi. This model utilizes Monte-Carlo tree search to effec-
but falls within a 0-1 range. A score of 0 signifies no similarity, tively select adversarial SQLi samples [21].
while 1 denotes exact replication, indicating identical queries. • LLM-SQLi. This model is a variant of XploitSQL that does not
The reward function assigns scores to different metrics for each leverage fine-tuning with RL. In other words, it comprises solely
query, which contribute to the overall reward. It has two parts: an LLM component.
the base reward and the similarity multiplier. The base reward is Evaluation Measures. To assess the impact of our adversarial
determined by comparing the metrics of the generated query to the generation algorithm on SQL injection classification methods, we
original query considering validity, injection and evasion measures. define a metric called Penetration Rate (𝑃) as follows: 𝑃 = 𝑇 𝑃𝐹+𝐹 𝑁 .
𝑁
Improvements in these metrics earn a reward, while regressions 𝐹 𝑁 represents the count of SQLi queries incorrectly classified as
incur a penalty. Finally, the base reward is adjusted by the similarity benign, while 𝑇 𝑃 denotes the number of SQLi payloads correctly
measure, which penalizes very high or low similarity but is more classified as attacks. It’s important to note that the penetration rate
lenient for evasive queries. The similarity measure helps ensure the signifies the proportion of SQLi attacks that were either missed or
model generates meaningful modifications. Very low similarity sug- incorrectly classified as benign.
gests random outputs, while very high similarity means the model
is copying the query. Both extremes are penalized. However, if the 5.2 Results
query can already evade detection, the penalty for high similarity
The bypass rates for six detection models—CNN, LSTM, AWS, F5,
is reduced to encourage similar evasive queries. This tiered reward
Fortinet, and ModSecurity—using the original dataset are 9.85%,
model guides XploitSQL toward creating more evasive queries.
6.35%, 9.78%, 40.23%, 100%, and 10.54%, respectively. It’s noteworthy
that applying XploitSQL and baselines is expected to increase
5 Experimental Evaluation
the bypass rate of detection models, thereby highlighting their
This section presents our experimental design and results, begin- vulnerability to SQLi. Conversely, a higher increase in the bypass
ning with a description of the data characteristics. rate resulting from an attack model demonstrates the effectiveness
of that model.
5.1 Experimental Design Table 1 presents the bypass rate of XploitSQL compared to base-
In this section, we detail our experimental design aimed at quantita- line models. For both ML-driven models, CNN and LSTM, Xploit-
tively assessing the efficacy of our proposed solution in generating SQL outperforms the baselines. Notably, XploitSQL surpasses Ad-
adversarial samples. vSQLi, the second-best attack model, by 8% and 6% for the CNN
Dataset. Our reference dataset used for generating adversarial sam- and LSTM models, respectively. For the evaluated WAFs, AWS, F5,
ples, referred to as the original dataset, is a combination of multiple Fortinet, and ModSecurity, XploitSQL significantly outperforms
datasets. It consists of a total of 35,574 samples, comprising 15,134 the baselines for two of them, while performing weaker for one.
malicious samples and 20,440 benign samples. These initial samples Specifically, XploitSQL exceeds the second-best model by 4% for
are used as the basis to generate new samples. The dataset result- AWS and by 29% for ModSecurity but underperforms by 23% for
ing from the iterative training process generated by our proposed F5. For Fortinet, all models achieve the same level of performance.
model is denoted as the adversarial dataset. XploitSQL’s main components, LLM, and RL, collaboratively
Detection Models. To showcase the effectiveness of XploitSQL iterate to produce increasingly evasive queries. The results of LLM-
compared to baseline approaches, we select two sets of SQLi de- xSQLi demonstrate the performance of XploitSQL without RL-
tection models, ML-based models and WAFs. ML-based models are based iterative training. These results affirm the significant contri-
widely used for text classification tasks such as spam detection bution of this component to XploitSQL’s performance.

4657
CIKM ’24, October 21–25, 2024, Boise, ID, USA Daniel Leung, Omar Tsai, Kourosh Hashemi, Bardia Tayebi, and Mohammad A. Tayebi

Injection Source CNN LSTM AWS F5 Fortinet ModSecurity

WAF-A-Mole 22.90% 10.22% 36.48% 48.32% 100% 23.31%
AdvSQLi 36.27% 26.43% 41.03% 78.49% 100% 8.89%
LLM-SQLi 38.90% 29.02% 52.96% 19.80% 100% 40.61%
XploitSQL 44.38% 32.60% 57.04% 55.27% 100% 52.74%
Table 1: The Bypass rate of XploitSQL and baselines for the evaluated SQLi detection models

In comparing the baselines, AdvSQLi outperforms WAF-a-MoLE models. For the first goal, the results clearly demonstrate the ef-
for all evaluated models except one. While both algorithms uti- fectiveness of our model, as evidenced by the performance drop
lize query mutation, AdvSQLi employs a more focused approach, in six different detection models. For the second goal, our model
enabling precise alterations within the query segment while pre- outperforms or matches the baseline in 11 out of 12 comparisons,
serving the overall SQL command structure. This preserves the showcasing the superiority of XploitSQL.
payload’s functionality and malicious intent. Moreover, AdvSQLi
utilizes Monte Carlo tree search to intelligently explore and select 6 Discussion
the most effective mutations based on context-free grammar rules.
6.1 Generating Insights for Defenders
An interesting observation from our experimental results is the
superiority of ML-driven solutions over traditional WAFs. This Targeting security products and analyzing them from an adversar-
advantage stems from the adaptive learning capabilities of ML- ial perspective is a widespread practice in the software industry.
driven WAFs. In contrast, traditional WAFs typically rely on static An essential application of XploitSQL is enhancing SQL injection
rule-based approaches, which lack the ability to adapt dynamically. detection tools, such as the WAFs evaluated in this study. WAF
Furthermore, this finding challenges recent claims made by major developers can leverage XploitSQL to identify and address vul-
vendors about using ML-driven solutions in their security prod- nerabilities in their products effectively. This process can occur
ucts, including WAFs. An unexpected result is the 100% bypass throughout the software development lifecycle, including code re-
rate for Fortinet WAF, signaling a significant vulnerability in this views, continuous integration and even threat modeling.
specific configuration. This finding suggests a potential issue with On inspecting the bypassed queries by XploitSQL for a rule-
the Fortinet WAF version used during testing, which might not be based WAF such as ModSecurity, we found a specific pattern that
effectively interpreting or filtering URL parameters, allowing SQL consistently bypassed the WAF; more specifically, the use of the
injection queries to pass through undetected. This vulnerability MIN() function. One such example is the query SELECT
indicates that the WAF model may not be correctly analyzing the MIN(injection) FROM database. The core rule set for ModSecu-
structure or content of the web requests it processes. rity is open source, allowing us to explore why the query pattern
Figure 2 depicts how XploitSQL’s performance evolves in each was bypassed [1]. In our research, we found ModSecurity does not
iteration across the evaluated WAFs. We observe a consistent up- implement any rules for this function (and other functions such
ward trend in all cases, with minor fluctuations in some instances, as MAX()). Furthermore, we can see that with XploitSQL’s output,
ultimately converging to an overall increasing trend. This shows the 846 of the 1371 queries generated in the final iteration contained
contribution of XploitSQL’s iterative learning to its performance. the use of the MIN() function. This validates our model has indeed
A unique aspect of XploitSQL is its adaptability in identify- identified a small gap that exists in a rule-based WAF to exploit it.
ing vulnerabilities in the target detection model. This is achieved Further analyzing the MIN() function vulnerability, we notice
through its iterative interactions with the target model, where it the same pattern for other WAFs as well. For F5, 79% of queries
learns the model’s weaknesses by sending various types of SQLi
queries and receiving feedback through the reward function defined
in the RL component. In iteration 𝑁 + 1, the query generated in 100.0%
CNN
iteration 𝑁 along with a fine-tuned prompt is passed to the LLM. 90.0% LSTM
AWS
This iterative process continues until a sufficiently evasive query is 80.0% F5
generated. Figure 3 illustrates the process of inference, showing a Fortinet
Bypass Rate

70.0% ModSecurity
sample original query and the final evasive query generated after
60.0%
the 16th round of interaction between XploitSQL and the target
model. For example, in earlier iterations, such as iterations 4 and 8, 50.0%

the LLM only learns to add random strings and unrelated tokens, 40.0%
resulting in queries that fail to evade detection. By iteration 16, the 30.0%
LLM refines the query, producing a more evasive query capable of
20.0%
bypassing the detection model. 2 4 6 8 10 12 14 16
In the experimental evaluation, we aimed to achieve two primary Iteration
goals: generating SQLi samples with higher evasiveness than those
in the training dataset and doing so more effectively than existing Figure 2: The bypass rate of XploitSQL across various training
iterations for evaluated detection models

4658
XploitSQL: SQL Injection with Language Models and Reinforcement Learning CIKM ’24, October 21–25, 2024, Boise, ID, USA

Original Query: A1 A2
WHERE 4548=4548--
' OR/**/1=1/**/UNION/**/
XploitSQL PostgresQL
SELECT/**/VERSION()
Append Prompt to the Query.

WHERE 4548=4548--
"This is a SQL injection query, modify the query to Give an injection
What SQL engine is
evade the SQL injection detection model." query to get the
the target using?
engine version

Attacker Q1 Q2
XPLOITSQL Iteration XPLOITSQL Iteration XPLOITSQL Iteration
4 8 12

Figure 4: Leveraging XploitSQL for reconnaissance

Generated Query Generated Query Generated Query

SELECT * FROM customers AS SELECT MIN(cname) FROM

SELECT * FROM customers
c1 JOIN customers AS c2 ON customers WHERE cid = 4548
c1.cid = c2.cid
WHERE c1.cid = 4548 --
WHERE cid = 4548 OR 4548 =
4548
OR 4548 = 4548 OR 4915 =
(SELECT
6.3 Model Limitation and Future Work
MIN(cid) FROM customers)
The performance of XploitSQL, is directly influenced by the size of
the LLM model used. Larger models show superior performance due
to their enhanced contextual understanding and advanced learning
Evasion: False Evasion: False Evasion: True
capabilities. For example, the model used in our study has only
77 million parameters, whereas newer models have billions of pa-
rameters, showcasing the significant differences in capability and
Figure 3: Queries generation across XploitSQL iterations performance. On the other hand, for the XploitSQL, training pro-
cess, we required two copies of the same LLM to implement the
actor-critic reinforcement learning model. This introduced addi-
tional inefficiencies in computational resource usage, ultimately
generated by XploitSQL were MIN() queries that bypassed the impacting the efficiency of our final model.
WAF, whereas for AWS, it was around 50%. This again highlights the Building on the methodologies outlined in this paper, we plan to
practical aspects of reinforcement learning in training XploitSQL conduct experiments using larger models to evaluate the correlation
for more evasive SQLi generation. between model size and performance. Refactoring the framework
In following responsible disclosure rules, before publishing and may also become necessary to enhance training efficiency, thus
with ample time, we will dispatch a comprehensive technical de- mitigating the substantial computational resource demands. We
scription of our vulnerability analysis to the relevant vendor or the believe leveraging LLM capabilities for security applications can
maintainers of open-source tools we tested in this study. open up promising research avenues, and our work stands as one of
the pioneering efforts in this domain, warranting further investment
and exploration.
6.2 Exploiting the Cyber Kill Chain
The Cyber Kill Chain is a model that outlines the various stages 7 Conclusion
of a cyber attack [28]. XploitSQL can be applied to various steps
There has been substantial investment in developing tools to ad-
of the cyber kill chain, including reconnaissance, weaponization,
dress web application vulnerabilities, such as SQL injection. Re-
exploitation, and exfiltration. In the reconnaissance phase, attackers
cently, machine learning applications in cybersecurity have shown
typically gather as much information as possible about the target
significant potential in enhancing these tools. However, these meth-
system. XploitSQL offers a new vector for extracting additional
ods are still not performing as expected, and SQL injection remains a
system information through SQLi. By training on the target system,
commonly exploited vulnerability. Additionally, adversarial agents
the LLM help can classify queries to assist attackers in understand-
are continually prepared to exploit security weaknesses. There-
ing which types of queries the system is vulnerable to, providing a
fore, improving detection tools requires a thorough analysis of
detailed map of potential weaknesses.
current vulnerability detection methods. In this work, we present
In the weaponization phase, the trained LLM can create a variety
an innovative method for generating adversarial SQL injection at-
of payloads based on the patterns it has learned. This allows at-
tacks by leveraging the integration of large language models and
tackers to generate specially crafted SQL injection queries tailored
reinforcement learning. Our model is designed to produce evasive
to the target system. During the exploitation phase, attackers can
SQLi samples, thereby enhancing the effectiveness of SQL injec-
use the knowledge gathered from reconnaissance, combined with
tion detection systems and enabling more comprehensive detection
the LLM’s capabilities as an injection generator, to exploit target
strategies. Extensive evaluations reveal the superior efficiency of
system vulnerabilities, including known CVE attacks and timing
our method compared to baseline approaches. In future work, we
attacks. Finally, in the exfiltration phase, attackers can generate
plan to enhance our approach by capitalizing on the capabilities of
and send exfiltration queries using XploitSQL to extract sensitive
large language models to improve their generalization, ensuring
information from the target system. As we have outlined, our com-
that our adversarial samples can effectively evade detection across
prehensive methodology enhances the effectiveness of each phase
a diverse range of machine learning models.
of the cyber kill chain; making it a powerful tool for testing target
systems from an attacker’s perspective.

4659
CIKM ’24, October 21–25, 2024, Boise, ID, USA Daniel Leung, Omar Tsai, Kourosh Hashemi, Bardia Tayebi, and Mohammad A. Tayebi

References [16] Kolosnjaji, B., Demontis, A., Biggio, B., Maiorca, D., Giacinto, G., Eckert,
[1] Owasp modsecurity core rule set. https://owasp.org/www-project-modsecurity- C., and Roli, F. Adversarial malware binaries: Evading deep learning for mal-
core-rule-set/. Accessed May 18, 2024. ware detection in executables. In 2018 26th European signal processing conference
[2] Owasp top ten. https://owasp.org/www-project-top-ten/. Accessed May 14, (EUSIPCO) (2018), IEEE, pp. 533–537.
2024. [17] Liu, T., Qi, Y., Shi, L., and Yan, J. Locate-then-detect: Real-time web attack detec-
[3] Vulnerabilities by types. https://www.cvedetails.com/vulnerabilities-by-types. tion via attention-based deep neural networks. In IJCAI (2019), pp. 4725–4731.
php. Accessed May 14, 2024. [18] Luo, A., Huang, W., and Fan, W. A cnn-based approach to the detection of sql
[4] Anderson, H. S., Kharkar, A., Filar, B., and Roth, P. Evading machine learning injection attacks. In 2019 IEEE/ACIS 18th International Conference on Computer
malware detection. black Hat 2017 (2017). and Information Science (ICIS) (2019), IEEE, pp. 320–324.
[5] Appelt, D., Nguyen, C. D., Panichella, A., and Briand, L. C. A machine- [19] Moradi Vartouni, A., Teshnehlab, M., and Sedighian Kashi, S. Leveraging
learning-driven evolutionary approach for testing web application firewalls. deep neural networks for anomaly-based web application firewall. IET Informa-
IEEE Transactions on Reliability 67, 3 (2018), 733–757. tion Security 13, 4 (2019), 352–361.
[6] Applebaum, S., Gaber, T., and Ahmed, A. Signature-based and machine-learning- [20] Prandl, S., Lazarescu, M., and Pham, D.-S. A study of web application fire-
based web application firewalls: A short survey. Procedia Computer Science 189 wall solutions. In Information Systems Security: 11th International Conference,
(2021), 359–367. ICISS 2015, Kolkata, India, December 16-20, 2015. Proceedings 11 (2015), Springer,
[7] Aydos, M., Aldan, Ç., Coşkun, E., and Soydan, A. Security testing of web pp. 501–510.
applications: A systematic mapping of the literature. Journal of King Saud [21] Qu, Z., Ling, X., Wang, T., Chen, X., Ji, S., and Wu, C. Advsqli: Generating
University-Computer and Information Sciences 34, 9 (2022), 6775–6792. adversarial sql injections against real-world waf-as-a-service. IEEE Transactions
[8] Betarte, G., Pardo, Á., and Martínez, R. Web application attacks detection on Information Forensics and Security (2024).
using machine learning techniques. In 2018 17th IEEE International Conference [22] Ramamurthy, R., Ammanabrolu, P., Brantley, K., Hessel, J., Sifa, R., Bauck-
on Machine Learning and Applications (ICMLA) (2018), IEEE, pp. 1065–1072. hage, C., Hajishirzi, H., and Choi, Y. Is reinforcement learning (not) for natural
[9] Demetrio, L., Biggio, B., Lagorio, G., Roli, F., and Armando, A. Explaining language processing: Benchmarks, baselines, and building blocks for natural
vulnerabilities of deep learning to adversarial malware binaries. arXiv preprint language policy optimization. arXiv preprint arXiv:2210.01241 (2022).
arXiv:1901.03583 (2019). [23] Roberts, A., Raffel, C., Lee, K., Matena, M., Shazeer, N., Liu, P. J., Narang,
[10] Diogenes, Y., and Ozkaya, E. Cybersecurity-attack and defense strategies: In- S., Li, W., and Zhou, Y. Exploring the limits of transfer learning with a unified
frastructure security with red team and blue team tactics. Packt Publishing Ltd, text-to-text transformer. Google, Tech. Rep. (2019).
2018. [24] Rosenberg, I., Shabtai, A., Rokach, L., and Elovici, Y. Generic black-box end-
[11] Gandhi, N., Patel, J., Sisodiya, R., Doshi, N., and Mishra, S. A cnn-bilstm to-end attack against state of the art api call based malware classifiers. In Research
based approach for detection of sql injection attacks. In 2021 International confer- in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018,
ence on computational intelligence and knowledge economy (ICCIKE) (2021), IEEE, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21 (2018), Springer,
pp. 378–383. pp. 490–510.
[12] Issakhani, M., Huang, M., Tayebi, M. A., and Lashkari, A. H. An evolutionary [25] Valenza, A., Demetrio, L., Costa, G., and Lagorio, G. Waf-a-mole: An adver-
algorithm for adversarial sql injection attack generation. In 2023 IEEE Interna- sarial tool for assessing ml-based wafs. SoftwareX 11 (2020), 100367.
tional Conference on Intelligence and Security Informatics (ISI) (2023), pp. 1–6. [26] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N.,
[13] Ito, M., and Iyatomi, H. Web application firewall using character-level convo- Kaiser, Ł., and Polosukhin, I. Attention is all you need. Advances in neural
lutional neural network. In 2018 IEEE 14th International Colloquium on Signal information processing systems 30 (2017).
Processing & Its Applications (CSPA) (2018), IEEE, pp. 103–106. [27] Xu, W., Qi, Y., and Evans, D. Automatically evading classifiers: A case study on
[14] Kar, D., Panigrahi, S., and Sundararajan, S. Sqligot: Detecting sql injection pdf malware classifiers. ndss, 2016.
attacks using graph of tokens and svm. Computers & Security 60 (2016), 206–225. [28] Yadav, T., and Rao, A. M. Technical aspects of cyber kill chain. In Security
[15] Kim, M.-Y., and Lee, D. H. Data-mining based sql injection attack detection using in Computing and Communications: Third International Symposium, SSCC 2015,
internal query trees. Expert Systems with Applications 41, 11 (2014), 5416–5430. Kochi, India, August 10-13, 2015. Proceedings 3 (2015), Springer, pp. 438–452.
[29] Zhang, L., Zhang, D., Wang, C., Zhao, J., and Zhang, Z. Art4sqli: The art of
sql injection vulnerability discovery. IEEE Transactions on Reliability 68, 4 (2019),
1470–1489.

4660