A Study of Online Database Servers: The Case of SQL - Injection, How Evil that could be?
George S. Oreku, Oreku, George S.
Asian Journal of Research in Computer Science · pp. 198–211 · Published 17 Dec 2022
10.9734/ajrcos/2022/v14i4304Abstract
SQL injection attack is one of the most serious security vulnerabilities in many Databases Managements systems. Most of these vulnerabilities are caused by lack of input validation and SQL parameters used particularity at this time of technology revolution. The results of a SQL injection attack (SQLIA) are unpleasant because the attacker could wipe the entire contents of the victim's database or shut it down. As such, SQLIA can be used as important weapons in cyber warfare. As an attempt of breaching of number of application data bases systems two SQL injection techniques were used to successful locating vulnerable points during this research which are Blind Text Injection Differential and Error based Exploitation. The motivations behind were to find out where the databases systems are most likely to face an attack and proactively shore up those weaknesses before exploitation by hackers. The success of both techniques is a result of poor web server (online database server) design especially in the selection of error messages (or answers) they display to website users if something goes wrong. The approach through examination of error messages (error codes) did enable to precisely know the backend Database Management System (DBMS) type and version and what exactly are parameters (variables) which can allow “illegally” injecting codes (a SQL query). Additionally, the paper presents SQLIA cases and their impact in Tanzania cyber space as well as it suggests the possible mitigation ways while reflecting the collected data with what currently existing in cyberworld as far as SQL injection attack is concern to present the reality.
References (17)
- 1 A Detection and Prevention Technique on SQL Injection Attacks [DOI]
- 2 Automatic detection and correction of web application vulnerabilities using data mining to predict false positives [DOI]
- 3 SQL DOM: compile time checking of dynamic SQL statements [DOI]
- 4 Safe query objects: statically typed objects as remotely executable queries [DOI]
- 5 An Improved Rainbow Table Attack for Long Passwords [DOI]
- 6 An Efficient Technique for Detection and Prevention of SQL Injection Attack using ASCII Based String Matching [DOI]
- 7 Preventing SQL Injection Attacks [DOI]
- 8 SQL Injection Behavior Mining Based Deep Learning [DOI]
- 9 Classification of SQL Injection Attacks Using Fuzzy Tainting [DOI]
- 10 SQL Injection Attacks: Detection And Prevention Techniques
- 11 Interoperable Medical Instrument Networking and Access System with Security Considerations for Critical Care [DOI]
- 12 Prevention of SQL Injection Attacks by Using Service Oriented Authentication Technique [DOI]
- 13 INTERNATIONAL JOURNAL OF COMPUTER APPLICATIONS [DOI]
- 14 Proceedings of the 23rd International Conference on World Wide Web [DOI]
- 15 Proceedings of the 5th ACM Conference on Data and Application Security and Privacy [DOI]
- 16 International Journal of Modeling and Optimization [DOI]
- 17 Intrusion Detection Technology [DOI]
Cited by 2
Ayman Emadeddin Hafez, M. Almustafa · International Journal of Safety and Security Engineering · 2024
Agus Tedyyana, Osman Ghazali, Onno W. Purbo · Indonesian Journal of Electrical Engineering and Computer Science · 2024
Article metrics
Real usage data collected on this platform.
5
Page views
0
PDF downloads
15
Outbound clicks
2
Citations
Views over time
Views by country
Approximate, from request IP at view time — not citizenship or institution. Countries with fewer than 5 views are grouped as "Other".
Traffic sources
Referring site, by host.
Views and downloads exclude known bots/crawlers. Citations combines this platform's own DOI-resolved index with each external source's own reported total — see Cited by above for individually listed citing works. Last refreshed 0 seconds ago.