动静结合的二阶SQL注入漏洞检测技术研究

发布时间：2018-10-29 18:27

【摘要】：二阶SQL注入是一种新型漏洞,广泛存在于Web应用程序中,并逐渐成为广大黑客行为的突破口。同传统一阶SQL注入一样,它能够造成信息泄露、命令执行、上传木马等多种危害,严重威胁目标系统的网络空间安全。由于其多阶段、隐式读写等特点导致目前缺乏有效的检测方法。因此,提出一种针对性的检测方法先于攻击之前发现漏洞,具有重大意义。分析二阶SQL注入漏洞特点以及现有检测方法的基础上,采用动静结合的方式,针对污点传播、多阶段和隐式读写的特点分别提出一种静态污点分析与模糊测试结合的检测方法,和一种动态污点分析与词法分析结合的检测方法,并实现检测原型STS和DTS。主要研究工作包括如下内容:1.本文首先系统分析二阶SQL注入的原理,阐述现有防御技术并分析不足。总结与漏洞检测相关的三个特点:污点传播、多阶段和隐式读写。2.提出一种静态污点分析与模糊测试结合的检测方法。针对二阶SQL注入的污点传播特性,采用基于数据流的污点分析技术。针对多阶段特性,引入对持久存储的检测,解决单纯通过动态分析无法处理应用程序多阶段间联系的问题。针对隐式读写特性,使用动态分析获取元数据,解决静态分析无法定位隐式数据库读写操作时持久存储位置的问题。最后,通过模糊测试验证疑似漏洞,降低误报率。实验表明,所提方法在可以接受的耗时范围内能够有效检测Web应用中二阶SQL注入漏洞。3.提出一种动态污点与词法分析结合的方式。对污点传播特性选择改进的动态污点分析,通过插桩对比测试用例与Sink参数值,检测污点数据传播。面对动态分析固有的覆盖率低的问题,通过词法分析获得输入点加以解决。并引入对持久存储和元数据分析,增加准确率。在词法分析的基础上,提出一种结合爬虫的输入点获取方式。实验表明,所提方法能够发现Web应用程序中的二阶SQL注入漏洞,具有进一步研究的价值。
[Abstract]:Second order SQL injection is a new type of vulnerability, which widely exists in Web applications and has gradually become a breakthrough in hacking. Like the traditional first-order SQL injection, it can cause information leakage, command execution, upload Trojan horse and so on, which seriously threaten the network space security of the target system. Due to its multi-stage, implicit reading and writing characteristics, there is a lack of effective detection methods. Therefore, it is of great significance to propose a targeted detection method to detect vulnerabilities before attacking. Based on the analysis of the characteristics of the second order SQL injection vulnerability and the existing detection methods, a static stain analysis method combined with fuzzy testing is proposed to deal with the characteristics of spot propagation, multi-stage and implicit reading and writing. And a detection method which combines dynamic stain analysis with lexical analysis, and realizes the detection prototype STS and DTS.. The main research work includes the following contents: 1. In this paper, the principle of second-order SQL injection is systematically analyzed, and the existing defense technology is discussed. Summarize three features related to vulnerability detection: stain propagation, multistage and implicit reading and writing. 2. A detection method combining static stain analysis with fuzzy test is proposed. According to the characteristics of contamination propagation of second order SQL injection, the stain analysis technique based on data flow is adopted. In view of the multi-stage characteristic, the detection of persistent storage is introduced to solve the problem that the multi-phase relationship of application can not be handled simply by dynamic analysis. To solve the problem that static analysis can not locate the persistent storage location of implicit database reading and writing operations, dynamic analysis is used to obtain metadata. Finally, the suspected vulnerability is verified by fuzzy test to reduce the false alarm rate. Experiments show that the proposed method can effectively detect the second order SQL injection vulnerability in Web applications within the acceptable time range. 3. 3. A method of combining dynamic stain and lexical analysis is proposed. The improved dynamic stain analysis is selected to analyze the characteristics of contamination propagation, and the test case and Sink parameter value are compared by inserting piles to detect the spread of contamination data. In the face of the problem of low coverage rate inherent in dynamic analysis, the input points obtained by lexical analysis are solved. And introduce persistent storage and metadata analysis to increase the accuracy. On the basis of lexical analysis, an input point acquisition method combined with reptile is proposed. Experiments show that the proposed method can find the second order SQL injection vulnerability in Web applications, and it is worthy of further study.
【学位授予单位】：华侨大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】