Testing and assessing web vulnerability scanners for persistent SQL injection attacks

Web application security scanners are automated tools used to detect security vulnerabilities in web applications. Recent research has shown that detecting persistent SQL injection vulnerabilities, one of the most critical web application vulnerabilities, is a major challenge for black-box scanners. In this paper, we evaluate three state of art black-box scanners that support detecting persistent SQL injection vulnerabilities. We developed our custom testbed "MatchIt" that tests the scanners capability in detecting persistent SQL injections. The results show that existing vulnerabilities are not detected even when these automated scanners are explicitly configured to exploit the vulnerability. The weaknesses of blackbox scanners identified reside in many areas: crawling web pages, input values and attack code selection, user registration and login, analysis of server replies and classification of findings. Because of the poor detection rate, we analyze the scanner's behavior and present a set of recommendations that could enhance the discovery of persistent SQL injection vulnerabilities.