A SQL injection statement parsing method based on a tree structure

Abstract

The application discloses a SQL injection statement analysis method based on a tree structure. When processing a SQL injection statement, fine-grained analysis, extraction and modification are needed, and string-level processing cannot support fine-grained analysis of the SQL injection statement. Based on the idea of the tree-shaped data structure, in combination with boundary division, feature extraction and other methods, the SQL injection statement is recursively parsed into a hierarchical tree structure, so that the SQL injection statement can be processed in a fine-grained manner, and the statement can be queried, analyzed, modified and the like at the level of atomic operation. The tree structure adopted by the application is a hierarchical tree, a parent node contains all information of a child node, and hierarchical analysis problems can be flexibly processed, and a parent node or a child node thereof can be dynamically selected for processing.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, relates to the field of SQL injection, and particularly relates to a SQL injection statement parsing method based on a tree structure. BACKGROUND

[0002] With the continuous evolution and global deployment of the Internet, network services are playing an increasingly important role in social infrastructure in daily life. On the other hand, they are also facing global threats from different places, different scales and through different ways. Common web threats include SQL (Structured Query Language) injection, cross-site scripting, cross-site request forgery, distributed denial of service, etc. SQL injection is one of the most common and most threatening attack methods, and attackers exploit security vulnerabilities by querying databases through SQL, thereby directly accessing unauthorized information, creating or modifying new user permissions or otherwise manipulating sensitive information.

[0003] As the most core content in the process of exploiting SQL injection vulnerabilities, SQL injection statements play a role in triggering vulnerabilities, stealing data, tampering with content, etc. From the perspective of security research, whether attacking or defending against SQL injection, fine-grained analysis of its injection statements is indispensable. Traditional methods mainly focus on string-level processing, which cannot effectively and accurately analyze key information. Fine-grained parsing can promote attack and defense research, such as optimization of SQL injection interception by firewalls, etc. SUMMARY

[0004] The application aims to solve the problems in the prior art and provides a SQL injection statement parsing method based on a tree structure.

[0005] The application aims to solve the problems in the prior art and provides a SQL injection statement parsing method based on a tree structure.

[0006] (1) The SQL injection statement includes three parts: the left HTTP parameter, the middle SQL query statement, and the right HTTP parameter. First, extract the HTTP parameter, which is the content that assists SQL injection according to its semantics, specifically the leftmost and rightmost content in the SQL statement, named S BL ,S BR .

[0007] (2) Extract the SQL query statement in the SQL injection statement, which is the middle part of the SQL statement and plays a role in querying data when performing SQL injection, named S Q , and thus obtain the complete SQL injection statement division, i.e. S={S BL ,SQ ,S BR}; and each part consists of a large number of SQL Tokens, namely Composition, that is

[0008] (3) Extract each SQL Token in S The database features in , including database name, database table name, database field name, etc., are stored in set D.

[0009] (4) Recursively convert S x Constructed into a tree structure T x ,include:

[0010] (4.1) Construct an empty tree structure T x , to store the information of the child nodes.

[0011] (4.2) According to the syntax of SQL language, S x Each SQL Token in Converted into the form of nodes in the tree structure The specific analysis method is to All information contained as Node attribute information; if the attribute information is included in set D, that is, it belongs to the database name, database table name, field name, etc., then this node is marked as unmodifiable, otherwise no additional marking is made.

[0012] (4.3) If Contains content that can be further parsed, such as nested SQL statements, equations, etc. As the parent node, The contents in are parsed as 's child nodes.

[0013] (4.4) If Insert all into T in the order of parsing x In the equation S is included. x The tree T of all information in x .

[0014] (5) Finally, S BL 、S Q With S BR Constructed as subtree T BL 、T Q With T BR , we get the complete tree representation of the SQL injection statement, that is, T={T BL ,T Q ,T BR}.

[0015] Compared with the prior art, the present invention has the following beneficial effects:

[0016] (1) String-level processing cannot support fine-grained analysis of SQL injection statements. The present invention parses SQL injection statements into a hierarchical tree structure, which can query, analyze, modify, and perform other operations on the statements at the atomic operation level.

[0017] (2) The tree structure adopted by the present invention is a hierarchical tree, in which the parent node contains all the information of the child nodes, and can flexibly handle the problem of analysis hierarchy, and can dynamically select the parent node or its child node for processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart that parses SQL injection statements into a tree structure;

[0019] Figure 2 Is the SQL query statement S Q Parsed into subtree T Q Schematic diagram of an embodiment. DETAILED DESCRIPTION

[0020] like Figure 1 As shown, the present invention provides a tree-structured SQL injection statement parsing method. By extracting HTTP parameters, SQL query statements, and database features, and then recursively building a hierarchical tree, the processing flow of SQL injection statements is further optimized and the analysis results are more fine-grained. Specifically, the following steps are included:

[0021] (1) The SQL injection statement S is [1'or 1=1--+], which includes the HTTP parameter [1'] on the left, the SQL query statement [or 1=1] in the middle, and the HTTP parameter [--+] on the right. First, extract the HTTP parameters, that is, extract the content that plays an auxiliary role in SQL injection according to its semantics. Specifically, the leftmost and rightmost contents in the SQL injection statement are named S BL ,S BR .

[0022] (2) Extract the SQL query statement in the SQL injection statement, that is, the middle part of the SQL injection statement, which plays the role of querying data during SQL injection, and is named S Q , so far we have obtained the complete SQL injection statement division, that is, S={S BL ,S Q ,S BR}; and each part is composed of a large number of SQL Tokens, namely x∈{BL,Q,BR}, SQL Token representing the x part, N xThe number of x-part SQL Tokens.

[0023] (3) Extract the database features in each SQL Token in S, including database name, database table name, database field name, etc. and store them into set D.

[0024] (4) Recursively construct S into tree structure T BL , including: BL

[0025] (4.1) Construct an empty tree structure T BL to store the information of child nodes.

[0026] (4.2) According to the syntax of SQL language, parse each SQL Token in S BL into the form of node in tree structure T . The specific parsing method is: take all the information contained in as the node attribute information of ; if the attribute information is contained in set D, i.e. belongs to database name, database table name, field name, etc., mark this node as unmodifiable, otherwise do not make additional marks.

[0027] (4.3) If contains further parseable contents, such as nested SQL statements, equalities, etc., such as [1=1] in this embodiment, take as the parent node, and parse the contents in as the child nodes of , which are [1], [space], [=], [space], [1] in this embodiment.

[0028] (4.4) If are all inserted into T BL in the order of parsing, the tree T BL containing all the information in S BL is obtained.

[0029] (5) As shown in Figure 2 , according to the method described in (4), correspondingly parse S Q [or 1=1] and S BR into sub-trees T Q and T BR , and obtain the complete tree representation of the SQL injection statement, i.e. T={T BL , T Q , T BR}.

[0030] ​​So, the SQL injection statement is parsed into a hierarchical tree structure, which is convenient for subsequent analysis and processing.

Claims

1. A tree-structured SQL injection statement parsing method, characterized in that: The steps include: (1) SQL injection statement S includes the left HTTP parameter S BL , intermediate SQL query statement S Q , HTTP parameter S on the right BR Three parts; first extract its HTTP parameters; (2) Extract the SQL query statement in the SQL injection statement, and thus obtain the SQL injection statement partition s={s BL ,s Q ,S BR }; and each part is composed of SQL Token, that is x∈{BL,Q,BR}, SQL Token representing the x part, N x Indicates the number of SQL Tokens in the x part; (3) Extract each SQL Token in S The database features in are stored in set D; (4) Recursively convert S x Constructed into a tree structure T x ,include: (4.1) Construct an empty tree structure T x , to store the information of the child node; (4.2) According to the syntax of SQL language, S x SQL Token Convert to a node in a tree structure The specific parsing method is: All information contained as Node attribute information; if the attribute information is included in set D, the node is marked as unmodifiable, otherwise no additional mark is made; (4.3) If Contains content that can be further parsed, then As the parent node, The contents in are parsed as 's child nodes; (4.4) Insert all into T in the order of parsing x After that, we get S x The tree T of all information in x ; (5) Finally, S BL 、S Q With S BR , parsed into subtree T BL 、T Q With T BR , get the complete tree representation of the SQL injection statement T={T BL ,T Q ,T BR }.

2. The tree-structured SQL injection statement parsing method according to claim 1, wherein: In step (1), the HTTP parameters of the SQL injection statement are the content extracted according to semantics to assist the SQL injection, specifically the leftmost and rightmost contents in the SQL statement.

3. The tree-structured SQL injection statement parsing method according to claim 1, wherein: In step (2), the SQL query statement is the middle part of the SQL statement, which plays the role of querying data when performing SQL injection.

4. The tree-structured SQL injection statement parsing method according to claim 1, wherein: In step (3), SQLToken The database features include database name, database table name, and database field name.

5. The tree-structured SQL injection statement parsing method according to claim 1, wherein: In step (4.3), The content that can be further parsed includes nested SQL statements and equations.

Images