Attack Generation and Vulnerability Discovery in Penetration Testing using Sql Injection - Upadhyaya, Jyotsnamayee; Panda, Namita; Acharya, Arup Abhinna (International Journal of Computer Sciences and Engineering, 2014)
Now a days the use of the world wide web (www) is increasing rapidly and leading to security breaches of a system so testing the software system has been made iterative. Testing requires effort, time and skilful person. Hacking mostly occur in banking sector and business organizations because they maintain all the conï¬dential information. One of the hacking technique is commonly occur in banking sector is sql injection. Security testing can be done by two ways i.e static analysis which is otherwise known as white box testing and by dynamic analysis which is known as black box testing.In this paper we have shown the penetration testing of web application to detect the sql injection vulnerability. This paper describes the penetration testing processes and mainly focuses on vulnerability discovery, attack generation and obtain the test cases and maintaining a pentester database which store all the attack responses. We have taken an internet banking transaction case study. This paper has the main motivation is to detect the sql injection by the attack generation. In sql injection system the attacker might insert a malicious code in the user input ï¬eld and trying to gain access the confidential and sensitive information from the database and making the database insecure. Penetration testing is widely used to simulate an attack of the web application and then analysis the attack pattern and give better solution to the system. This paper has given an overview of the penetration testing process and sql injection attack and a pentester database.