The essence of command injection attacks in web applications

DOI10.1145/1111037.1111070MaRDI QIDQ5348937zbMATH OpenOpenAlexFDO

Authors Zhendong Su, Gary Wassermann

Publication date 21 August 2017

Published in Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages (Search for Journal in Brave)

Full work available at URL https://doi.org/10.1145/1111037.1111070

zbMATH Keywords

parsingruntime verificationgrammarsweb applicationscommand injection attacks

Mathematics Subject Classification ID

Mathematical aspects of software engineering (specification, verification, metrics, requirements, etc.) (68N30) Database theory (68P15) Grammars and rewriting systems (68Q42) Internet topics (68M11)

Recommendations

• Preventing injection attacks with syntax embeddings
• Defining code-injection attacks
• Applied Cryptography and Network Security
• A novel method for SQL injection attack detection based on removing SQL query attribute values
• A survey on server-side approaches to securing web applications

Cited in

(10)

• Context-oriented web application protection model
• Defining code-injection attacks
• Trading plaintext-awareness for simulatability to achieve chosen ciphertext security
• Automation of the construction of models of normal program behavior
• A novel method for SQL injection attack detection based on removing SQL query attribute values
• Preventing injection attacks with syntax embeddings
• Static detection of DoS vulnerabilities in programs that use regular expressions
• A survey on server-side approaches to securing web applications
• Formal methods for web security
• Applied Cryptography and Network Security

This page was built for publication: The essence of command injection attacks in web applications

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q5348937)