Research On SQL Injection Vulnerability Attack Model

With the rapid development of Web 2.0 technology and mobile Internet, a wide range of Web applications are becoming an indispensable part of people's lives. At the same time, the security problem of Web application has been paid more and more attention. Although the problem of SQL injection has been put forward for many years, it is still one of the most common Web application security problems, and the harm to Web application system is still considerable. Therefore, it is necessary to study the SQL injection vulnerability detection.At present, the detection of SQL injection is mainly used penetration testing method, the principle is to identify attacks by simulation Web application exists security vulnerabilities, this test can analyze the behavioral results, and can reflect the vulnerability utilization, complexity Low, to adapt to a wide range of widely used security vulnerability scanner is based on this idea. However, most of the research on the penetration testing of SQL injection focuses on information collection and response analysis, and the research on the generation of attack cases is still lacking. The randomness of test cases is strong and lacks regularity,which results in omission test.In this paper, it studies the use case generation of SQL injection vulnerability penetration test in the direction of penetration testing,hoping to improve the test cases in current penetration test, which can not fully reflect the deficiency of SQL injection attack and generate simple and optimized test cases. Reduce the problem of SQL injection test, and improve the accuracy of penetration testing.In order to achieve these objectives, this paper mainly carried out the following research and work: SQL injection of the causes of the study, to clarify the causes. The classification of SQL injection is explored, the classification of current research is explored, and the common SQL injection classification method is summarized. Combined with the actual needs of Web application security testing, a SQL injection attack model based on data transmission channel is proposed which is used to guide the generation of SQL injection test cases. Under the guidance of the proposed attack model, the formal description of SQL injection test cases is given. And to instantiate it to generate optimized SQL injection test cases. An automated SQL injection vulnerability detection system was developed. The penetration test of the Web application was performed using the generated optimized SQL injection test cases to improve the accuracy of the penetration test.In this paper, the main innovation of this paper is to propose a SQL injection attack model based on data transmission channel. The model describes the SQL injection attack from the perspective of the data flowing out from the SQL injection, and the SQL injection attack model in current research. The new model in this study focuses on the purpose of stealing data in SQL injection and makes a further study to describe the rules of attack cases in this kind of SQL injection attacks more precisely,so as to more accurately reflect the data stealing SQL injection attack behavior of the law.In order to verify the performance of the system, this paper designed a specific experiment to test the system, and the test results were studied and analyzed, affirmed the effectiveness of the system and detection of comprehensive.