An assessment of the impact of Web Application Firewalls and Database Intrusion Detection Systems on the accuracy of SQLi testing.The main research contributions in this dissertation are: The devised testing approaches are evaluated with SIX’ IT platform, which consists of various web services that process several thousand financial transactions daily. Specifically, the devised testing approaches are automated, applicable in black box testing scenarios, able to assess and bypass Web Application Firewalls, and use an accurate test oracle. We analyse the challenges SIX is facing in security testing and base our testing approaches on assumptions inferred from our findings. issuing of credit and debit cards, settlement of card transactions, online payments, and point-of-sale payment terminals. SIX Payment Services is a leading provider of financial services in the area of payment processing, e.g. The work presented in this dissertation was conducted in collaboration with SIX Payment Services (formerly CETREL S.A.). the generation of test cases or the definition of test oracles, and in combination they provide a holistic approach. Each of the presented approaches covers a different aspect of security testing, e.g. In this dissertation, we propose several security testing approaches that evaluate web applications and services for SQLi vulnerabilities and common IT infrastructure components such as Web Application Firewalls for their resilience against SQLi attacks. Despite having received much attention from academia and practitioners, the prevalence of SQLi is common and the impact of their successful exploitation is severe. Marco Vieira, University of Coimbra, PortugalĪbstract: Injection vulnerabilities, such as SQL Injection (SQLi), are ranked amongst the most dangerous types of vulnerabilities.

Alexander Pretschner, Technische Universität München, Germany PhD Defense: Automated Security Testing of Web-Based Systems against SQL Injection Attacks Partager cet événement :

Test site for sql injection