Scribd Logo
Upload

Welcome to Scribd!

  • 4 views

    Meru University of Science and Technology: Addressing SQL Injections Threats in Web Security

    Uploaded by

    y mugambi
    ADRESSING SQL INJECTIONS

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Meru University of Science and Technology: Addressing SQL Injections Threats in Web Security

    Uploaded by

    y mugambi
    4 views10 pages
    ADRESSING SQL INJECTIONS

    Original Title

    SQL PPT

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    ADRESSING SQL INJECTIONS

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    4 views10 pages

    Meru University of Science and Technology: Addressing SQL Injections Threats in Web Security

    Uploaded by

    y mugambi
    ADRESSING SQL INJECTIONS

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 10

    Meru University of Science and 1

    Technology
    School of Computing and Informatics
    ADDRESSING SQL INJECTIONS THREATS IN WEB SECURITY

    LEXY IDA AFANDI- CT207/103428/20


    ANTHONY OMULO OTIENO- CT207/103215/20
    YVONNE WAMUYU MUGAMBI- CT207/103415/20
    CHARITY NDULU KANINI- CT207/106316/21
    THIERRY ORLANDO- CT207/106350/21

    SUPERVISOR: MWENDA GICHURU

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    2
    BACKGROUND OF STUDY
    In the realm of web security, SQL injection (SQLi) poses a significant and persistent threat to web applications, allowing malicious actors to
    exploit vulnerabilities and potentially access sensitive data or execute harmful commands. Despite considerable attention and efforts to
    address this issue, SQL injection remains prevalent due to evolving attack techniques and the emergence of sophisticated tools. Various
    mitigation strategies, including input validation, parameterized queries, and security frameworks like ZAP (Zed Attack Proxy), have been
    proposed to combat SQL injection vulnerabilities. However, their effectiveness hinges on factors such as implementation quality and
    adaptability to evolving threats.

    A multitude of research endeavors have focused on detecting, preventing, and mitigating SQL injection vulnerabilities in web applications,
    exploring aspects such as vulnerability analysis, attack modeling, and detection algorithms. Additionally, studies have examined the
    economic ramifications of SQL injection attacks, underlining the financial losses organizations may incur due to data breaches and service
    disruptions. Insights gleaned from these studies have informed best practices and guidelines, emphasizing the importance of proactive
    defense mechanisms and comprehensive security approaches to mitigate SQL injection threats effectively.

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    3
    Problem Statement
    SQL Injection Vulnerability: Unauthorized execution of SQL commands through input fields, compromising
    data integrity, confidentiality, and availability.
    Inadequate Input Validation and Sanitization: Lack of robust validation and sanitization practices in web
    applications, allowing for manipulation by attackers.
    Persistence of Vulnerabilities: Despite mitigation efforts, vulnerabilities persist due to the complexity of
    modern web applications and evolving attack methods.
    Dynamic Nature of Web Applications: The dynamic nature of web applications complicates detection and
    prevention efforts, exposing them to various SQL injection attack vectors.

    A multi-layered defense strategy will be implemented to fortify our system against SQL injection attacks.
    Rigorous input validation mechanisms will be deployed, tailored to detect and reject any malicious entries
    effectively. Additionally, parameterized queries will be adopted to separate SQL code from user input, thereby
    preventing injection attacks at the code level. This separation ensures that user input is treated purely as data
    and not executable code. Furthermore, runtime monitoring tools will be integrated to conduct real-time
    analysis of query behaviors. This proactive approach enables the timely detection of anomalies indicative of
    SQL injection attempts, allowing for swift response and mitigation measures to be implemented. By
    combining these measures, our system will be significantly bolstered against SQL injection threats, ensuring
    the integrity and security of our data and applications.

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    4
    Research Objectives

    Main Objective
    Develop and implement a comprehensive defense strategy for database-driven web applications to mitigate SQL injection attacks
    effectively.

    Specific Objectives
    • Implement rigorous input validation tailored to each input field's requirements to detect and reject malicious entries.
    • Adopt parameterized queries to separate SQL code from user input, preventing injection attacks at the code level.
    • Integrate runtime monitoring tools into the application environment for real-time analysis of query behaviors to detect
    anomalies indicative of SQL injection.

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    5
    Literature Review
    Author Year Title Finding
    Halfond & Dynamic Tainting Analysis Tracking and labeling data sources can ensure proper
    Orso 2005 for SQL Injection Prevention sanitization of user inputs before database interaction.
    Anley et al. 2002 Signature-Based Detection Comprehensive and regularly updated signature databases
    Systems for SQL Injection are crucial for identifying and preventing SQL injection
    Prevention attacks
    Wassermann 2008 Limitations of Static Analysis Static analysis has limitations and requires complementing
    & Su in SQL Injection Prevention with dynamic analysis methods

    Kals et al. 2017 Machine learning-based Advocates for the use of machine learning to enhance
    approaches for enhancing intrusion detection systems against evolving SQL injection
    intrusion detection tactics.
    Jovanovic et 2006 Positive Tainting as a Positive tainting marks data as safe, complementing
    al. Preventive Measure for SQL traditional detection methods
    Injection
    Athanasopoul 2018 Challenges in Adapting to Attackers continuously adapt, posing challenges for
    os et al. Evolving Attack Vectors traditional detection methods

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    6
    Research Methodology
    In our project, we've chosen to implement the Agile methodology for system development. This approach offers us a
    range of benefits that align perfectly with our goals and project requirements. Firstly, Agile provides the flexibility and
    adaptability we need through its iterative and incremental development process. This allows us to adjust to changing
    requirements and security challenges as they arise, ensuring that our system remains robust and up-to-date. Continuous
    testing and feedback are integral components of Agile. This means we can promptly identify and address any
    vulnerabilities that may emerge during development. By continuously testing our system, we can ensure its resilience
    against SQL injection attacks and other security threats.
    Moreover, Agile's dynamic approach to software development enables us to remain responsive to evolving security
    threats. This proactive stance allows us to adapt our security measures in real-time, ensuring that our system is always
    equipped to handle the latest threats effectively. Another key advantage of Agile is its emphasis on collaboration among
    team members. By fostering close collaboration, we can integrate security measures seamlessly from the outset of the
    development process. This ensures that security considerations are embedded into every stage of our project, reducing the
    likelihood of overlooking critical vulnerabilities.
    security testing tools such as ZAP (Zed Attack Proxy) SQL map will be instrumental in simulating SQL injection attacks,
    identifying vulnerabilities, and validating the effectiveness of implemented security measures.

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    7
    Results and Discussion
    Metrics Results
    Key Findings
    Model Evaluation etc.
    Model Deployment

    October 20, 2024


    Meru University of Science and
    Technology
    School of ComputingGNATT
    and Informatics
    CHART
    8
    TASK JAN FEB MARCH APRIL

    CHOOSING A RESEARCH TOPIC

    TOPIC APPROVAL

    PROPOSAL WRITING

    RESEARCH PROPOSAL APPROVAL

    SYSTEM DESIGN

    SYSTEM DEVELOPMENT

    SYSTEM SUBMISION

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics
    9
    Budget
    ITEM NO. PARTICULARS COST(SH)
    1 5,000
    Printing and
    photocopying

    2 Travelling cost 10,000

    3 Binding cost 1,000


    4 Airtime 3,000

    5 Internet cost 3,000

    6 Hardware 60,000
    components

    TOTAL
    81,500

    October 20, 2024


    Meru University of Science and
    Technology
    School of Computing and Informatics Postgraduate
    1
    Research Seminar
    0

    End of Presentation

    October 20, 2024

    You might also like