Advanced SQL Injection In SQL Server Applications

By C. Anley. 2002

375 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/1eca8957ec83a9ec6950724d0d5767c053cce189

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

SQLrand: Preventing SQL Injection Attacks (2004, methodology): “This technique has been shown to be quite effective in practice [5, 27].”
A Classification of SQL Injection Attacks and Countermeasures (2006, background): “References: [1, 28, 21, 18]”
AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks (2005, background): “This broad definition includes all of the variants of SQLIA reported in Anley’s extensive documentation [1].”
Defending Against Injection Attacks Through Context-Sensitive String Evaluation (2005, background): “Considerably less attention has been given to the related problem of injection vulnerabilities [3], which instead has been investigated mainly by practitioners [1, 2, 8, 12, 13].”
Mop: an efficient and generic runtime verification framework (2007, background): “As an example, Figure 10 shows a raw MOP specification that detects SQL-injection attacks [3]: malicious users try to corrupt a database by inserting unsafe SQL statements into the input to the system.”
Edge Computing Security: State of the Art and Challenges (2019, methodology): “Hence, SQL injection is one of the main methods for malware injection [95].”
Finding Security Vulnerabilities in Java Applications with Static Analysis (2005, background): “However, despite Java language's safety, it is possible to make logical programming errors that lead to vulnerabilities such as SQL injections [1] [2] [14] and cross-site scripting attacks [7] [22] [46].”
Web application security assessment by fault injection and behavior monitoring (2003, methodology): “We referenced the existing literature on SQL injection techniques to create a set of SQL injection patterns [ 6 ] [16] [25] [36] [60].”
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, background): “This allows us to reconstruct which parts of the strings are possibly derived from (malicious) user input, and which parts stem from static strings embedded in the program source code.”