Due to well-hidden and stage-triggered properties of second-order SQL injections in web applications, current approaches are ineffective in addressing them and still report high false negatives and false positives. To reduce false results, we propose a P roxy-based s tatic analysis and dy namic ex ecution m echanism towards detecting, locating and preventing second-order SQL injections (SQLPsdem). The static analysis first locates SQL statements in web applications and identifies all data sources and injection points (e.g., Post, Sessions, Database, File names) that injection attacks can exploit. After that, we reconstruct the SQL statements and use attack engines to jointly generate attacks to cover all the state-of-the-art attack patterns so as to exploit these applications. We then use proxy-based dynamic execution to capture the data transmitted between web applications and their databases. The data are the reconstructed SQL statements with variable values from the attack payloads. If a web application is vulnerable, the data will contain malicious attacks on the database. We match the data with rules formulated by attack patterns to detect first and second-order SQL injection vulnerabilities in web applications, particularly the second-order ones. We use a representative and complete coverage of attack patterns and precise matching rules to reduce false results. By escaping and truncating malicious payloads in the data transmitted from the web application to the database, we can eliminate the possible negative impact of the data on the database. In the evaluation, by generating 52,771 SQL injection attacks using four attack generators, SQLPsdem successfully detects 26 second-order (including 13 newly discovered ones) and 375 first-order SQL injection vulnerabilities in 12 open-source web applications. SQLPsdem can also 100% eliminate the malicious impact of the data with negligible overhead.

中文翻译：

---

SQLPsdem：一种基于代理的机制，用于检测、定位和防止二阶 SQL 注入


由于 Web 应用程序中二阶 SQL 注入的隐藏性和阶段触发特性，当前的方法无法有效解决这些问题，并且仍然报告较高的误报和误报。为了减少错误结果，我们提出了一种基于代理的静态分析和动态执行机制来检测、定位和防止二阶 SQL 注入（SQLPsdem）。静态分析首先定位 Web 应用程序中的 SQL 语句，并识别注入攻击可以利用的所有数据源和注入点（例如 Post、会话、数据库、文件名）。之后，我们重构SQL语句并使用攻击引擎联合生成攻击以覆盖所有最先进的攻击模式，从而利用这些应用程序。然后，我们使用基于代理的动态执行来捕获 Web 应用程序及其数据库之间传输的数据。数据是重构的 SQL 语句，其中包含来自攻击负载的变量值。如果Web应用程序存在漏洞，数据将包含对数据库的恶意攻击。我们将数据与攻击模式制定的规则进行匹配，以检测 Web 应用程序中的一阶和二阶 SQL 注入漏洞，特别是二阶 SQL 注入漏洞。我们使用具有代表性和完整的攻击模式覆盖和精确的匹配规则来减少错误结果。通过对从Web应用程序传输到数据库的数据中的恶意负载进行转义和截断，我们可以消除数据对数据库可能产生的负面影响。 在评估中，通过使用四个攻击生成器生成 52,771 个 SQL 注入攻击，SQLPsdem 成功检测到 12 个开源 Web 应用程序中的 26 个二阶（包括 13 个新发现的）和 375 个一阶 SQL 注入漏洞。 SQLPsdem还可以100%消除数据的恶意影响，而开销可以忽略不计。