The essence of command injection attacks in web applications

摘要: Web applications typically interact with a back-end database to retrieve persistent data and then present the user as dynamically generated output, such HTML web pages. However, this interaction is commonly done through low-level API by constructing query strings within general-purpose programming language, Java. This ad hoc because it does not take into account structure of output language. Accordingly, inputs are treated isolated lexical entities which, if properly sanitized, can cause application generate unintended output. called command injection attack, which poses serious threat security. paper presents first formal definition attacks in context applications, gives sound complete algorithm for preventing them based on context-free grammars compiler parsing techniques. Our key observation that, an attack succeed, input that gets propagated or document must change intended syntactic document. general apply many forms attacks. We validate our approach SqlCheckS, implementation setting SQL evaluated SqlCheckS real-world systematically compiled input. produced no false positives negatives, incurred low runtime overhead, applied straightforwardly written different languages.