Detection method and system for SQL injection loophole

Abstract

The invention discloses a key technique-SQL injection vulnerability detection technique of a host vulnerability scanning system as one important product for network security. The SQL injection vulnerability detection technique is characterized by submitting normal access request data and different types of SQL injection data to a server, receiving results returned by the server, then cross-comparing the returned results of different requests, and further determining exists of SQL injection vulnerabilities from the processing of submitted data by the server according to the compared results. To-be-certified website addresses are defined by means of website crawler, browser plug-in and manual input. One or a plurality of attacking templates of four different types of attacking templates canbe selected to detect exists of SQL injection vulnerabilities on the to-be-certified websites. And the exists of SQL injection vulnerabilities during processing the user-submitted data by the server can be judged through cross-comparing the returned results of the normal access requests and SQL injection statements, under the condition that the server shields error information.

Description

Technical field [0001] The present invention relates to a SQL (Structured Query Language) injection vulnerability detection method and system. It is a protection method and system for processing electronic and digital data and preventing unauthorized use. It is applied to a network system and belongs to an important product of network security. One of the key technologies of the host vulnerability scanning system. Background technique [0002] With the development of the Internet, the client / server (B / S) model has been more and more widely used. In the B / S mode, there is often a place for data interaction between the user and the back-end database server, that is, the user enters and submits data through a form on the client's web page, and the server application constructs SQL statements based on the data submitted by the user and submits it to the database The server performs processing and returns the processing result to the user. When developing applications in the B / S mod...

AI Technical Summary

Problems solved by technology

[0007] 1. The method of relying on the status code returned by the server to determine whether there is a vulnerability is too simple, and when the server uses a custom error message to shield the running error prompt, it will not be able to make a normal judgment, resulting in false positives

[0008] 2. The method of judging whether the server is running incorrectly through keywords is not accurate enough. When the server is running normally, but the return page happens to have a predefined keyword, or the server is running incorrectly, but the set return content does not include the predefined keyword. When using words, it is impossible to make accurate judgments, resulting in false negatives and false negatives

Images