Zobrazit v EDS

The Construction of a Static Source Code Scanner Focused on SQL Injection Vulnerabilties in Java

Uloženo v:
Podrobná bibliografie
Název: The Construction of a Static Source Code Scanner Focused on SQL Injection Vulnerabilties in Java
Autoři: Zurita Rubin de Celis, Carla
Zdroj: Theses, Dissertations and Culminating Projects
Informace o vydavateli: Montclair State University Digital Commons
Rok vydání: 2023
Sbírka: Montclair State University Digital Commons
Témata: Static analysis, Source Code Scanner, Security Testing, SQL Injection, Computer Sciences
Popis: SQL injection attacks are a significant threat to web application security, allowing attackers to execute arbitrary SQL commands and gain unauthorized access to sensitive data. Static source code analysis is a widely used technique to identify security vulnerabilities in software, including SQL injection attacks. However, existing static source code scanners often produce false positives and require a high level of expertise to use effectively. This thesis presents the design and implementation of a static source code scanner for SQL injection vulnerabilities in Java queries. The scanner uses a combination of pattern matching and data flow analysis to detect SQL injection vulnerabilities in code. The scanner identifies vulnerable code by analyzing method calls, expressions, and variable declarations to detect potential vulnerabilities. To evaluate the scanner, malicious SQL code is manually injected in queries to test the scanner's ability to detect vulnerabilities. The results showed that the scanner could identify a high percentage of SQL injection vulnerabilities. The limitations of the scanner include the inability to detect runtime user input validation and the reliance on predefined patterns and heuristics to identify vulnerabilities. Despite these limitations, the scanner provides a useful tool for junior developers to identify and address SQL injection vulnerabilities in their code. This thesis presents a static source code scanner that can effectively detect SQL injection vulnerabilities in Java web applications. The scanner's design and implementation provide a useful contribution to the field of software security, and future work could focus on improving the scanner's precision and addressing its limitations.
Druh dokumentu: text
Popis souboru: application/pdf
Jazyk: unknown
Relation: https://digitalcommons.montclair.edu/etd/1325; https://digitalcommons.montclair.edu/context/etd/article/2327/viewcontent/ZuritaRubindeCelisCarla_Redacted.pdf
Dostupnost: https://digitalcommons.montclair.edu/etd/1325
https://digitalcommons.montclair.edu/context/etd/article/2327/viewcontent/ZuritaRubindeCelisCarla_Redacted.pdf
Přístupové číslo: edsbas.37087A32
Databáze: BASE
Popis
Abstrakt:SQL injection attacks are a significant threat to web application security, allowing attackers to execute arbitrary SQL commands and gain unauthorized access to sensitive data. Static source code analysis is a widely used technique to identify security vulnerabilities in software, including SQL injection attacks. However, existing static source code scanners often produce false positives and require a high level of expertise to use effectively. This thesis presents the design and implementation of a static source code scanner for SQL injection vulnerabilities in Java queries. The scanner uses a combination of pattern matching and data flow analysis to detect SQL injection vulnerabilities in code. The scanner identifies vulnerable code by analyzing method calls, expressions, and variable declarations to detect potential vulnerabilities. To evaluate the scanner, malicious SQL code is manually injected in queries to test the scanner's ability to detect vulnerabilities. The results showed that the scanner could identify a high percentage of SQL injection vulnerabilities. The limitations of the scanner include the inability to detect runtime user input validation and the reliance on predefined patterns and heuristics to identify vulnerabilities. Despite these limitations, the scanner provides a useful tool for junior developers to identify and address SQL injection vulnerabilities in their code. This thesis presents a static source code scanner that can effectively detect SQL injection vulnerabilities in Java web applications. The scanner's design and implementation provide a useful contribution to the field of software security, and future work could focus on improving the scanner's precision and addressing its limitations.