Random4 and hirshberg algorithm
Download as PPTX, PDF0 likes83 views
This document summarizes techniques for preventing SQL injection attacks. It discusses the Random4 and Hirschberg algorithms. Random4 encrypts user input using a lookup table, preventing attacks. Hirschberg finds similarities in input data to the database using dynamic programming. While more computationally intensive, Hirschberg does not require encryption. The document also outlines different types of SQL injection attacks and compares the complexity of the Random4 and Hirschberg approaches.
Random4 and hirshberg algorithm
- 1. Authors : Chintan Panjwani,Shivkumar Mishra,Prof. Veena Kulkarni
- 3. Introduction • SQLIA is a type of attack in which the attacker tries to enter the system by manipulating SQL queries i.e. by injecting malicious queries in input fields of a web application • Random4 algorithm is basically used to encrypt the data from the input fields of application by using a lookup table for encryption • Hirschberg algorithm uses dynamic programming approach for finding an optimal sequence alignment
- 4. Types of SQLI attacks • Tautology SELECT * FROM TABLE WHERE UNAME=”ABC” AND PWD=”ANYTHING” OR ‘1’=’1’; As 1=1 is always true, attacker gains access to the database. • Incorrect queries Error: SELECT USERNAME,PASSWORD FROM STUDENT WHERE USERNAME=ABC’ • Piggy backed queries SELECT * FROM USER WHWRE ID=123; DROP TABLE USER; • Blind Injection
- 5. Execution model • Random4 framework Random4 lookup table Encryption technique
- 6. Execution model • Hirschberg algorithm Hirschberg algorithm Using Hirschberg Algorithm to find similarities
- 7. Prevention strategies • For Tautology ‘1’=‘1’ gets encrypted so it returns false • For Piggy backed queries Eg. “User” becomes “UserA2;h” • For Incorrect queries Similar to piggy backed queries • For Blind Injection Eg. “123” becomes “g4a”
- 8. Complexity analysis • Hirschberg algorithm – Time Complexity O(nm) where n is string in the database and m is the input data – Space Complexity O(min(m , n)) • Random4 algorithm – Time Complexity Encryption requires to access the lookup table which increases the time complexity compared to Hirschberg algorithm – Space Complexity The lookup table also needs to be stored which increases the space complexity
- 9. Comparison Sr. no. Parameters Random4 Hirschberg 1. Encryption User input Not required 2. Computational overhead Less More 3. Time complexity Less More 4. Space complexity Less More
- 12. ©2015 TCET. All rights reserved. The information herein is for informational purposes only and represents the current view of TCET IT Department as of the date of this presentation.