Method for driving web application penetration testing by applying SGM-SQL (sage grant management-structured query language) injection model

Abstract

The invention relates to a method for driving web application penetration testing by applying an SGM-SQL (sage grant management-structured query language) injection model, in the method, a web application penetration test framework driven by an SGM-SQL injection attack model is defined; by defining the SGM-SQL injection attack model in the framework and guiding the definition of a formalized definition set of SQL injection safety loopholes and a formalized description system of penetration test cases thereof, the accurate criterion for judging existence of the safety loopholes and the orderedcomplete test cases are further provided for the penetrating testing, and an SQL injection safety loophole penetration test algorithm driven by the SGM-SQL injection attack model is accordingly provided, thereby improving the accuracy of the web application SQL injection safety loophole penetration testing. Practices prove that the method is credible, systematic and complete, and can be applied in the field of the web application safety loophole penetration testing.

Description

【Technical field】 [0001] The invention belongs to the technical field of web application security loophole detection and model-based testing, and in particular relates to a method for modeling SQL injection attacks by using SGM and driving SQL injection security loophole penetration testing with the model. 【Background technique】 [0002] With the development of Internet technology, the problem of security loopholes in Web applications has increasingly become a significant Internet security problem. One of the most harmful vulnerabilities is the SQL injection attack vulnerability (SQL injection). SQL injection attack is a type of security vulnerability that is not difficult to attack but has serious consequences and has a wide impact. It needs to be paid attention to and studied. [0003] Software security testing is an effective way to detect whether there are security vulnerabilities in web applications. Currently, the testing of web application security vulnerabilities m...

AI Technical Summary

Problems solved by technology

[0005] At present, the main problem of penetration testing of web applications is that the testing accuracy is not high

This is caused by many reasons, such as the following research problems that need to be solved urgently: 1) the lack of research on the accurate definition and description of web application security vulnerabilities, resulting in the lack of criteria for accurately determining the existence of vulnerabilities in testing; 2) the use of security vulnerability penetration test cases Insufficient research on rule generation and expression, high blindness in the use of use cases, and poor test results; 3) Lack of a macro overview of the factors that improve test accuracy, and does not point out which key factors affect the accuracy of penetration testing from a macro perspective, and then specify What aspects should be coordinated to carry out research on improving test accuracy?

The existence of these problems has resulted in the low accuracy of current web application penetration testing

Images