SQL Injection Attack Scanner Using Boyer-Moore String Matching Algorithm

Abstract

In this day and age, the proliferation of fast Internet and advancedtechnology, have contributed to the development of millions of webapplications and the number is going to continue to increase every day.With their various purposes such as business promotions, onlineshopping, e-learning and social media, it has increased the possibilityof privacy violation, information leakage, unauthorized access and someother security aspects. These attacks can be launched by using severalmethods; one of them is through a Structured Query Language (SQL)injection. Even though there are several approaches that have beenintroduced to detect SQL injections such as Brute Force andKnuth-Morris-Pratt, there are still some weaknesses encountered.Therefore in this paper, we studied about the SQL injection methodologyand detection models for web vulnerabilities. Apart from that, weproposed a detection model to scan SQL injection on the web environment,based on the defined and identified criteria using the Boyer-MooreString Matching Algorithm. From several tests that had been done, theresults showed that the proposed model is able to detect vulnerable webapplications with the defined criteria of the SQL Injection. Inconclusion, this proposed model can be used by web application developerand system admin to secure the application from being attacked andcompromised.