模型驱动的Web应用SQL注入渗透测试

Model-driven penetration test of the SQL injection in Web applications

针对结构化查询语言（SQL）注入渗透测试用例不充分造成测试漏报的问题，对基于形式化建模生成渗透测试用例问题进行了研究，提出了以下方法：将SQL注入漏洞渗透测试用例生成分为两步：第1步建立渗透测试用例的形式化模型，以用例模型更全面、有规律地描述当前各种SQL注入攻击的方法模式，指导生成更多种类的用例输入；第2步提出若干新的SQL注入漏洞渗透测试用例覆盖度准则，将用例模型实例化、生成覆盖更多样式的用例输入。实验表明，用上述方法生成的用例，优于当前其它研究中使用的随机枚举用例，可更有效地测出隐藏于Web应用不足防御措施之后的SQL注入漏洞，从而降低渗透测试结果的漏报。

To resolve the problem of how to generate adequate test cases to reduce the false negative in penetration testing for the SQL （structured query language ） injection vulnerability, this paper proposes a novel model-driven penetra- tion test case generation method. This method divides the penetration test case generation for the SQL injection vul- nerability into two steps ： 1 ） Building the model of penetration test case, which reveals the regularity of current SQL injection attacks to expound what test case should be used and describes them in a formal way; and 2） Instantiating the penetration test case model according to a series of coverage criteria proposed in the study to generate the test case covering more attack patterns. The experiment shows that compared with randomly enumerated test cases used in the current related work, the test cases generated by the proposed method can more effectively find the SQL in- jection vulnerability hidden behind the inadequate defense mechanism, which reduces the false negative and im- proves the test accuracy.