Black-box SQL Injection Testing (TR-SnT-2014-1)

Web services are increasingly adopted in various domains, from finance and e-government to social media. As they are built on top of the web tech-nologies, they suffer also an unprecedented amount of attacks and exploita-tions like the Web. Among the attacks, those that target SQL injection vul-nerabilities have consistently been top-ranked for the last years. Testing to detect such vulnerabilities before making web services public is crucial. We present in this report an automated testing approach, namely µ4SQLi, and its underpinning set of mutation operators. µ4SQLi can produce effective inputs that lead to executable and harmful SQL statements. Executability is key as otherwise no injection vulnerability can be exploited. Our eval-uation demonstrated that the approach outperforms contemporary known attacks in terms of vulnerability detection and the ability to get through an application firewall, which is a popular configuration in real world.