Detection method and system for SQL injection loophole

Abstract

The invention discloses a key technique-SQL injection vulnerability detection technique of a host vulnerability scanning system as one important product for network security. The SQL injection vulnerability detection technique is characterized by submitting normal access request data and different types of SQL injection data to a server, receiving results returned by the server, then cross-comparing the returned results of different requests, and further determining exists of SQL injection vulnerabilities from the processing of submitted data by the server according to the compared results. To-be-certified website addresses are defined by means of website crawler, browser plug-in and manual input. One or a plurality of attacking templates of four different types of attacking templates can be selected to detect exists of SQL injection vulnerabilities on the to-be-certified websites. And the exists of SQL injection vulnerabilities during processing the user-submitted data by the server can be judged through cross-comparing the returned results of the normal access requests and SQL injection statements, under the condition that the server shields error information.

Description

technical field [0001] The present invention relates to a SQL (Structured Query Language) injection vulnerability detection method and system, which is a protection method and system for electronic digital data processing and preventing unauthorized use, which is applied to network systems and belongs to an important product of network security. A key technology of host vulnerability scanning system. Background technique [0002] With the development of the Internet, the client / server (B / S) model has been more and more widely used. In the B / S mode, data interaction between the user and the background database server often occurs, that is, the user enters and submits data through a form on the web page of the client, and the application program of the server constructs an SQL statement based on the data submitted by the user and submits it to the database. The server processes and returns the processing result to the user. When developing applications in the B / S mode, many ...

AI Technical Summary

Problems solved by technology

[0007] 1. The method of relying on the status code returned by the server to determine whether there is a vulnerability is too simple, and when the server uses a custom error message to shield the running error prompt, it will not be able to make a normal judgment, resulting in false positives

[0008] 2. The method of judging whether the server is running incorrectly through keywords is not accurate enough. When the server is running normally, but the return page happens to have a predefined keyword, or the server is running incorrectly, but the set return content does not include the predefined keyword. When using words, it is impossible to make accurate judgments, resulting in false negatives and false negatives

Images