Authors:
Mohammad Qbea’h
1
;
Saed Alrabaee
1
and
Djedjiga Mouheb
2
Affiliations:
1
Information Systems and Security, College of IT, United Arab Emirates University, Al Ain, Abu Dhabi, U.A.E.
;
2
Department of Computer Science, College of Computing and Informatics, University of Sharjah, U.A.E.
Keyword(s):
SQL Injection Attack, Cross Site Scripting, Encoding, Base64 Encoding, XSS, Hex Encodings, SQLIA, Android Attack.
Abstract:
Among the most critical and dangerous attacks is the one that exploits Base64 or Hex encoding technique in SQL Injection (SQLIA) and Cross Site Scripting (XSS) attacks, instead of using plain text. This technique is widely used in most dangerous attacks because it evades detection. Therefore, it is possible to bypass many filters such as IDS, without taking into account the transformation methodologies of the symbols and characters. Moreover, it reserves the same semantics with different syntax. Attackers can exploit this serious technique to reach unseen data and gain valuable benefits. To the best of our knowledge, this paper presents the first technique that focuses on detecting and preventing transformed SQLIA and XSS from Base64 and Hex encoding. We perform scanning and analyzing methods by targeting two places: (i) Input boxes and (ii) Strings in page URLs. Then, we decode the inputs and compare them with our stored suspicious tokens. Finally, we perform string matching and mut
ation mechanisms to revoke the activity of malicious inputs. We have evaluated our technique and the results showed that it is capable to detect and prevent this transformed attack.
(More)