NDLI: The essence of command injection attacks in web applications

Please wait, while we are loading the content...

Why dependent types matter

The next 700 data description languages

A hierarchical model of data locality

Simplifying reductions

Formal certification of a compiler back-end or: programming a compiler with a proof assistant

Engineering with logic: HOL specification and symbolic-evaluation testing for TCP implementations

Decidability and proof systems for language-based noninterference relations

On flow-sensitive security types

A logic for information flow in object-oriented programs

Polymorphic regular tree types and patterns

Verifying properties of well-founded linked lists

Environment analysis via ΔCFA

Small bisimulations for reasoning about higher-order imperative programs

A fixpoint calculus for local and global program flows

The Scala experiment: can we provide better language support for component systems?

Adventures in time and space

N-synchronous Kahn networks: a relaxed model of synchrony for real-time systems

Compiler-directed channel allocation for saving power in on-chip networks

Fast and loose reasoning is morally correct

Modular set-based analysis from contracts

Stratified type inference for generalized algebraic data types

Hybrid type checking

A polymorphic modal type system for lisp-like multi-staged languages

The next mainstream programming language: a game developer's perspective

A virtual class calculus

Interruptible iterators

Specifying C++ concepts

Frame rules from answer types for code pointers

Certified assembly programming with embedded code pointers

Associating synchronization constraints with data in an object-oriented language

Autolocker: synchronization inference for atomic sections

Protecting representation with effect encapsulation

The essence of command injection attacks in web applications

Harmless advice

A verifiable SSA program representation for aggressive compiler optimization

Staged allocation: a compositional technique for specifying and implementing procedure calling conventions

The essence of command injection attacks in web applications

Content Provider	ACM Digital Library
Author	Wassermann, Gary Su, Zhendong
Abstract	Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack, which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SqlCheckS, an implementation for the setting of SQL command injection attacks. We evaluated SqlCheckS on real-world web applications with systematically compiled real-world attack data as input. SqlCheckS produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.
Starting Page	372
Ending Page	382
Page Count	11
File Format	PDF
ISBN	1595930272
DOI	10.1145/1111037.1111070
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2006-01-11
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Command injection attacks Parsing Runtime verification Web applications Grammars
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

The essence of command injection attacks in web applications

The essence of command injection attacks in web applications (2006)

The essence of command injection attacks in web applications (2006)

The Essence of Command Injection Attacks in Web Applications (2006)

Experimental analysis of attacks against web services and countermeasures

Hacking the DBMS to Prevent Injection Attacks

Commix: Automating Evaluation and Exploitation of Command Injection Vulnerabilities in Web Applications

Analysis and classification of SQL injection vulnerabilities and attacks on web applications

SMask: preventing injection attacks in web applications by approximating automatic data/code separation

The essence of command injection attacks in web applications

Similar Documents

The essence of command injection attacks in web applications

The essence of command injection attacks in web applications (2006)

The essence of command injection attacks in web applications (2006)

The Essence of Command Injection Attacks in Web Applications (2006)

Experimental analysis of attacks against web services and countermeasures

Hacking the DBMS to Prevent Injection Attacks

Commix: Automating Evaluation and Exploitation of Command Injection Vulnerabilities in Web Applications

Analysis and classification of SQL injection vulnerabilities and attacks on web applications

SMask: preventing injection attacks in web applications by approximating automatic data/code separation

The essence of command injection attacks in web applications