SQL注入漏洞快速检测技术的研究

发布时间：2018-10-19 13:10

【摘要】：伴随着互联网时代快速发展的节奏,基于web开发的应用程序也越来越成熟,技术也越来越复杂。由于web应用丰富的功能特性,以及便于通过互联网对信息进行比较、处理、传播的能力,使得web应用极易成为流行的攻击目标。所以为了保障web应用的安全性,提前对web应用进行安全漏洞的检测是十分有必要的。根据OWASP在2013年公布的十大最流行的web安全漏洞中,注入漏洞(其中以SQL注入漏洞为主)作为第一大漏洞位居榜首。由此可见对SQL注入漏洞检测技术的研究是具有十分重要的现实意义的。本文首先概述了对SQL注入漏洞研究的背景及其意义,然后分别介绍了国内外对SQL注入漏洞检测技术的发展研究。发现以往的这些研究多关注于检测用例(即payloads)的充分性和准确性上,几乎没有对庞大的检测用例集合中各测试用例的关联性以及独特性进行研究,而且在进行SQL注入漏洞检测时,也只是随机从payloads集合中选取检测用例,没有考虑到payloads自身的规律性。在本文中,我们先对SQL注入漏洞进行了基础介绍,然后概述了在SQL盲注中的一些高级检测技巧,最后针对目前存在的检测技术缺陷问题,从SQL注入漏洞的payloads角度出发,提出了优化改进,主要包括以下4个方面:(1)基于字母频率的优化。有时候在已经确定存在SQL注入漏洞的情况下,当需要对后台数据库明文关键字进行猜解时,我们考虑到各个英文字母在英语单词中出现的频率问题,提出基于字母频率的方式来进行猜解以提高检测效率,更进一步,我们还提出了基于双字母组频率的方式来猜解明文关键字,以减少后台数据库请求次数。(2)基于字母频率和二进制搜索相结合的优化。很多时候,我们不能确定所要猜解的关键字是否经过加密方式处理,或者关键字中不仅仅只包含英文字母。针对这种情况,本文提出了基于字母频率和二进制搜索相结合的方式来猜解关键字,首先进行一定次数的字母频率(包括双字母组频率)方式猜解,然后再利用二进制搜索方式进行搜索,相比较对整张字母表进行检索,极大地提高了检测效率。(3)基于自动扩展的优化。针对各检测用例之间的关联性,本文提出自动扩展的方式来自动选择下一个可能用于检测SQL注入漏洞的payload。本文主要从五个方面来进行自动扩展:大小写变种扩展,编码变换扩展,SQL注释扩展,空字节扩展以及拆分与平衡扩展。(4)基于缓存加权的优化。针对以往随机枚举检测用例的缺陷,本文提出在选取各测试用例的时候按照一定的次序来选择,即采用缓存加权的方式来选取测试用例,首先对payloads集合进行分类,然后在每个分类下设置一个缓存机制,将一些常用到的权重较大的检测用例存放到缓存机制中,该缓存机制还有动态替换的特点,在进行SQL注入漏洞检测时,先从缓存机制中选取payload,如果还未检测成功,则从缓存机制以外再依次选取payload来进行检测。更进一步,针对本文提出的payloads优化方法,我们通过大量的实验证明,这些优化方法确实提高了检测效率,而且针对大型工程性项目的检测,其优势更为明显。
[Abstract]:With the rapid development of Internet era, the application of web-based development is becoming more and more mature, and the technology is becoming more and more complex. Due to the rich functional characteristics of the web application, and the ability to compare, process and propagate the information through the Internet, the web application is easy to become a popular attack target. Therefore, in order to guarantee the security of the web application, it is necessary to detect the security vulnerability of the web application in advance. In the top ten most popular web security vulnerabilities published by OWASP in 2013, an injection vulnerability (mainly SQL injection vulnerability) topped the first major flaw. Therefore, it is very important to study the research of SQL injection vulnerability detection technology. This paper first summarizes the background and significance of the research on SQL injection vulnerability, and then introduces the development of SQL injection vulnerability detection technology at home and abroad. it has been found that previous studies have focused on the adequacy and accuracy of detection cases (i. e. payloads), almost no studies have been made on the relevance and uniqueness of each test case in a large set of detection examples, and when a sql injection vulnerability detection is performed, It is also only a random selection of the detection example from the payloads set, and the regularity of payloads itself is not taken into account. In this paper, we first introduce the SQL injection vulnerability, then outline some advanced detection techniques in the SQL blind note, finally, based on the existing detection technology defect problem, the optimization improvement is put forward from the point of payloads of SQL injection vulnerability. It mainly includes the following four aspects: (1) optimization based on the letter frequency. sometimes in the case where a SQL injection vulnerability has been determined, when the background database plaintext keyword needs to be guessed, we take into account the frequency problems that each English letter appears in the alphabet, and proposes a way to guess the solution based on the letter frequency to improve the detection efficiency, Further, we also propose a double-letter-group-frequency-based approach to guess de-plaintext keywords to reduce background database requests. (2) Optimization based on combination of letter frequency and binary search. In many cases, we cannot determine whether the keywords to be guessed are processed by encryption or not only English letters are included in the keyword. In view of this situation, this paper proposes a combination of letter frequency and binary search to guess the solution key, first carry on a certain number of letter frequency (including the double-letter group frequency) way guess the solution, then use the binary search way to search, Compared with the alphabet, the search efficiency is greatly improved. (3) Optimization based on automatic extension. In view of the correlation between the detection cases, this paper proposes an automatic extension method to automatically select the next payload which may be used to detect the SQL injection vulnerability. This article mainly extends the automatic expansion from five aspects: case variant extension, coding transformation extension, SQL annotation extension, null byte expansion, and split and balance extension. (4) Optimization based on cache weight. aiming at the defects of the prior random enumeration detection example, the invention provides a method for selecting a test case according to a certain sequence when selecting each test case, namely, selecting a test case by adopting a cache weighting method, firstly classifying the payloads set, and setting a caching mechanism under each classification, storing a plurality of commonly used detection cases with larger weights into a caching mechanism, wherein the caching mechanism has the characteristics of dynamic replacement; when the SQL injection vulnerability detection is carried out, the payload is firstly selected from the caching mechanism, and if the detection is not detected, then the payload is selected from the cache mechanism in sequence for detection. Furthermore, in view of the payloads optimization method proposed in this paper, we prove that these optimization methods have improved the detection efficiency, and the advantages are more obvious for the detection of large engineering projects.
【学位授予单位】：浙江工商大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】