ABSTRACT

SQL injection attack is widely used by attackers to gain unauthorized access to systems. This software system is developed to prevent unauthorized access to system using SQL injection attacks. This is done by adding unique value and a signature based authentication technique to verify authenticity. SQL injection is a major security issue these days that allows an attacker to gain access of a web system or application exploiting certain vulnerabilities. This method exploits various web application parameters such as transmitting the traveling form data parameters with an efficient integration of amino acid codes aligned in it. In other words, this software project puts forth a method to analyze and detect the malicious code to find out and prevent the attack. It uses an alternative algorithm for signature based scanning method; this method is based on a different divide and conquers strategy that detects attacks based on various time/space parameters. This innovative system has proved successful in preventing various SQL injection attacks based on its efficient attack detection strategies.

CHAPTER 1.  INTRODUCTION

With the presence of information technology in this age; data can be stored, manipulated, transferred and processed but there are also some agents that want to make use of the data for negative intentions. Among the various security threats a web application is exposed to, SQL Injection Attack (SQLIA) has taken the forefront. It has prevailed as a popular attack method. Using a SQL injection attack, an attacker can extract, modify or destroy the back end database of web applications. The simplicity of attacking a web application using SQL injection and abundance of vulnerable applications on the Internet has largely contributed to widespread data breach incidents [1] .

SQL injection attack is widely used by attackers to gain unauthorized access to systems. This software system is developed to prevent unauthorized access to system using SQL injection attacks. This is done by adding unique value and a signature based authentication technique to verify authenticity. SQL injection is a major security issue these days that allows an attacker to gain access of a web system or application exploiting certain vulnerabilities. This method exploits various web application parameters such as transmitting the traveling form data parameters with an efficient integration of amino acid codes aligned in it. In other words, this software project puts forth a method to analyze and detect the malicious code to find out and prevent the attack. It uses an alternative algorithm for signature based scanning method; this method is based on a different divide and conquers strategy that detects attacks based on various time/space parameters. This innovative system has proved successful in preventing various SQL injection attacks based on its efficient attack detection strategies.

1.2 Problem Statement

With increasing the use of the Internet in the era, most of the web applications developers are not aware of privacy and security issues. Whereby many kinds of attacks against web applications making web applications attractive targets of security attacks. Web applications and are often stored valuable and confidential information, which making them a good target for penetration threats that may be achieved by database injection. The potential downtime and damages for the services if any could  lead to incurable damage. Hence, it is necessary to design a to prevent and detect such threats.

1.3  Objectives

The general objective  of this research is to develop an SQL injection Prevention System.  The specific objectives include

1. To determine the various methods of SQLI attack,
2. identify the attacking techniques and write guidelines for the programmers,

• Design a system to prevent the SQLi attacks.

1.4 Significance of the Thesis

The prevalence of SQLIAs and the potential damage that they can cause, including identity theft and the extraction of financial data, requires good solutions to address these exploits.  The applications affected by SQLIAs is constantly increasing, and history has shown that depending on website and application developers to write perfect code that adequately checks user input is an inadequate solution. Alternative approaches are needed to help protect these databases.

The basic intention of this thesis is to design a solution for preventing SQLIA where the solution does not depend on good coding practices.  In addition, the method should provide good performance.  Although checking of user input for correctness and safety has previously been proposed, such approaches may take a significant number of clock cycles and require the programmer to implement them correctly.  In this research, we explore the potential implementation of alternative checker for user input in dedicated hardware instead of software.  Specifically, we implemented a string search and replace method in hardware with the goal of removing one of the primary vectors of SQLIA attacks. The strings to be matched in SQL statements are the action-based binding keywords necessary for joining attacking parameters to a query in a SQL statement.  The use of an FPGA (Field-Programmable Gate Array) for this checking allows multiple characters and keywords to be checked simultaneously in parallel.  When a keyword is found, it is removed from the user’s input and replaced by null characters. Thus, only sanitized user input may be seen by the system. By replacing these keywords with nulls, we achieve a very good secured database system, which is immune to SQLIAs that depend on those keywords.

1.5 Thesis Organization

The rest of the thesis is organized as follows. In Chapter 2, we review the basic concepts of SQL and investigate various factors leading to SQLIAs. In particular, we try to answer why SQLIAs occur and describe the exploits in a web application that an attacker uses to cause a SQLIA. In Chapter 3, we describe work done previously on the prevention of SQLIAs. In Chapter 4, we describe, our proposed method for preventing SQLIAs. In Chapter 5, we describe implementation of our design and evaluate the performance of our design when implemented in software and hardware. Furthermore, we compare the performance of our design in hardware to other previously applied solutions in hardware. Finally, we conclude our thesis in Chapter 6, and lay our plans for future

work on this project.