A Survey Of Sql Injection Countermeasures <s> Program Analysis Techniques <s> Many data-intensive applications dynamically construct queries in response to client requests and execute them. Java servlets, e.g., can create string representations of SQL queries and then send the queries, using JDBC, to a database server for execution. The servlet programmer enjoys static checking via Java's strong type system. However, the Java type system does little to check for possible errors in the dynamically generated SQL query strings. Thus, a type error in a generated selection query (e.g., comparing a string attribute with an integer) can result in an SQL runtime exception. Currently, such defects must be rooted out through careful testing, or (worse) might be found by customers at runtime. In this paper, we present a sound, static, program analysis technique to verify the correctness of dynamically generated query strings. We describe our analysis technique and provide soundness results for our static analysis algorithm. We also describe the details of a prototype tool based on the algorithm and present several illustrative defects found in senior software-engineering student-team projects, online tutorial examples, and a real-world purchase order system written by one of the authors. <s> BIB001 </s> A Survey Of Sql Injection Countermeasures <s> Program Analysis Techniques <s> In data-intensive applications, it is quite common for the implementation code to dynamically construct database query strings and execute them. For example, a typical Java servlet Web service constructs SQL query strings and dispatches them over a JDBC connector to an SQL-compliant database. The servlet programmer enjoys static checking via Java's strong type system. However, the Java type system does little to check for possible errors in the dynamically generated SQL query strings. For example, a type error in a generated selection query (e.g., comparing a string attribute with an integer) can result in an SQL runtime exception. Currently, such defects must be rooted out through careful testing, or (worse) might be found by customers at runtime. In this paper, we describe JDBC Checker, a sound static analysis tool to verify the correctness of dynamically generated query strings. We have successfully applied the tool to find known and unknown defects in realistic programs using JDBC. We give a short description of our tool in this paper. <s> BIB002 </s> A Survey Of Sql Injection Countermeasures <s> Program Analysis Techniques <s> Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%. <s> BIB003 </s> A Survey Of Sql Injection Countermeasures <s> Program Analysis Techniques <s> With the recent rapid increase in interactive Web applications that employ back-end database services, an SQL injection attack has become one of the most serious security threats. The SQL injection attack allows an attacker to access the underlying database, execute arbitrary commands at intent, and receive a dynamically generated output, such as HTML Web pages. In this paper, we present our technique, Sania, for detecting SQL injection vulnerabilities in Web applications during the development and debugging phases. Sania intercepts the SQL queries between a Web application and a database, and automatically generates elaborate attacks according to the syntax and semantics of the potentially vulnerable spots in the SQL queries. In addition, Sania compares the parse trees of the intended SQL query and those resulting after an attack to assess the safety of these spots. We evaluated our technique using real-world Web applications and found that our solution is efficient in comparison with a popular Web application vulnerabilities scanner. We also found vulnerability in a product that was just about to be released. <s> BIB004
To overcome the shortcomings of defensive programming techniques, developers can use program analysis techniques to test programs and to discover defects they have overlooked. One popular technique for program analysis is static checking. Researchers have proposed various static checking techniques. Gould and colleagues BIB001 BIB002 proposed a technique called JDBC checker to perform static analysis and to verify the type correctness of dynamically generated SQL queries BIB002 . For example, Assume the following code fragment is in a Java application program that is used to obtain the total price of an order. String query = "select '$' || " + "sum(price) from orders where oid=' "+order_ID +"'"; There is a type matching error in the code. The string concatenates the character '$' with the numeric value of sum(price). It is a runtime error, so the Java's type system cannot find it. Improper type checking can cause security problems of an application. The JDBC Checker is to enforce type correctness using finite state automata. Researchers have tested the tool on a variety of web applications and have found many known and unknown type mismatching errors existing in programs successfully BIB001 . Although it is good for preventing SQL injection attacks that take advantage of type mismatching bugs, it is not good at finding more general forms of SQL injection attacks such as SQL injections that generate type correct queries  BIB004 . WebSSARI (Web application Security by Static Analysis and Runtime Inspection) BIB003 is another tool that can perform static analysis. It uses a lattice-based static analysis algorithm. The tool can perform static checking and insert runtime guard code automatically if insecure pieces of code are detected. Static checking techniques help programmers optimize codes, but they usually cannot find all the vulnerabilities in a system. Kosuga et al. BIB004 proposed a testing and debugging technique called Sania for detecting SQL injection vulnerabilities during the development phase. Sania constructs a parse tree for every intended SQL query and considers all the leaf nodes that take user inputs as vulnerable spots. Sania can automatically generate attack requests based on a list of existing attack codes collected in an investigation. It constructs a parse tree for each attack request and compares the tree with the one built for the intended SQL query. If the two trees are different, Sania determines there is a SQL injection vulnerability. To test the technique's performance, Sania was compared with an existing popular web application scanner called Paros. Sania outperformed Paros by being able to detect more vulnerabilities and generating fewer false positives. However, this technique cannot guarantee low false negative rate because it is hard to collect a complete list of attack codes. In addition, because Sania only checks the spots that take user input values, it cannot discover Lateral SQL injection vulnerabilities that do not require user input. Another type of program analysis techniques is black-box testing. The testing is not based on the knowledge of a program's source code. Instead, testers take an external approach to get an attacker's point of view. They interact with the application by entering various crafted user inputs and observing program behaviors so that they can find vulnerable points in an application. Researchers have proposed several black-box assessment frameworks such as WAVES, AppScan, WebInspect and ScanDo BIB003 . There are also a bunch of commercial tools and open source tools available  . The drawback of this approach is that it usually cannot find all of the vulnerabilities existing in a system. How many can be found depends on the testing data used.