以合理輸入值驗證為基礎之組合型SQL指令植入式攻擊防禦

A Defense against Compositional SQL Injection Attack through Validation on Input Legitimacy

李安娜(An-Na Lee)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2011年)

https://doi.org/10.6840/cycu201101067

摘要

由於Web 2.0 的發展，使得動態網頁結合資料庫存取成為目前網頁應用服務最常用的系統架構。資料庫的使用使得網頁應用服務很容易便能提供多樣性及客製化的動態變化，然而風險也隨著這些好處而來，SQL 指令植入式攻擊即是針對網頁應用服務程式組合使用者輸入形成SQL指令的漏洞來攻擊資料庫，可能導致資料庫內的資料被竊取，或讓資料庫被破壞。過濾使用者輸入，攔截可能形成SQL 指令植入式攻擊的輸入可以防止攻擊發生，採用這種策略的防護方法有許多，其中之一的兩步驟輸入驗證法可以在網頁伺服器接收參數時防禦，以防止網頁伺服器回應的錯誤訊息導致資訊洩漏。由於SQL 指令的複雜性以及網頁應用程式寫作方式的多樣化，所以SQL 指令有跨頁組合的可能，而SQL 指令中的參數亦可由多個使用者輸入組合而成。我們以兩步驟的使用者輸入驗證防禦機制為基礎，將其防禦範圍延伸成考慮網頁應用程式中含有跨頁組合SQL 指令或是多輸入組合參數的情形。在靜態分析階段，我們發展了一個新的靜態分析程序，可以找出跨頁SQL 指令的組合方式，以及所有使用者輸入參數與SQL指令之間的關係，我們同時提出一個新的動態分析程序，在線上進行動態使用者輸入驗證時能夠辨識並攔截跨頁組合SQL 指令及多輸入組合SQL參數而成的攻擊。我們完成了系統雛型，並加以測試，測試的結果顯示我們的方法可以防禦跨頁及多輸入組合SQL 指令植入式攻擊。

關鍵字

輸入驗證 ； SQL指令植入式攻擊 ； 網頁應用程式安全

並列摘要

With Web2.0 as the dominant web service model, the majority of dynamic web services adopted the system structure with front end web application programs responsible for customized web page generation and back end database serving as data repository such that flexible and customizable dynamic services can be easily achieved. However, it comes with the price of the potential risk of SQL injection attacks which may lead to data theft or content destruction, even database crash. Filtering user inputs and blocking those from which SQL injection attack may be formed can prevent attacks from happening. Among the solutions adopting the input validation strategy, a two step input validation method consisting of performing static analysis on web applications for collecting input attribute information as well as applying dynamic analysis on run-time submitted user inputs according its attributes can provide adequate protection against SQL injection attack while preventing malicious user from obtaining error messages. However, a SQL command can be a product of a sequence of operations crossing multiple web application program boundaries, and a parameter in a SQL command can be the composition of multiple-inputs. In this thesis, we extended the original two-step input-validation method so that web applications with multiple page SQL command formulation as well as multi-input parameter can be protected. We devise an enhanced static analysis procedure to discover the composition sequence of multi-page-generated SQL command as well as the relation between user inputs and corresponding SQL parameters. We also proposed a modified dynamic analysis procedure to validate inputs according to the information obtained from the static analysis. A prototype system has been developed and tested. The result shows that our proposed enhanced two-step input-validation method can defend a web application against multi-page and multi-input SQL injection attacks.

並列關鍵字

web application security ； SQL injection attacks ； input validation

參考文獻

[1] 吳靜茹，「以合理輸入值為基礎之SQL指令植入式攻擊防禦」，中原大學研究所，碩士論文，中華民國九十八年七月。

[2] Justin Clarke, Rodrigo Macros Alvarez, Dave Hartley, Joseph Hemler, Alexander Kornbrust, Haroon Meer, Gary O’Leary-Steele, Alberto Revelli, Marco Slaviero, Dafydd Stuttard. "SQL Injection Attacks and Defense", Burlington, MA: Syngress Pub., 2009

[4] Yao-Wen Huang, Shih-Kun Huang, Tsung-Po Lin and Chung-Hung Tsai. “Web Application Security Assessment by Fault Injection and Behavior Monitoring”, In Proceedings of the 12th international conference on World Wide Web(WWW 2003), pages 148-159, 2003

[11] Yuji Kosuga, Kenji Kono, Miyuki Hanaoka, Miho Hishiyama, Yu Takahama. “Sania: Syntactic and Semantic Analysis for Automated Testing against SQL Injection.”, In Proceedings of the Twenty-Third Annual Computer Security Applications Conference, pages 107-117, Dec. 2007.

[13] Hossain Shahriar and Mohammad Zulkernine. “MUSIC: Mutation-based SQL Injection Vulnerability Checking.”, In Proceedings of the 8th International Conference on Quality Software (QSIC), pages 77-86, Aug. 2008.