Structured query language injection penetration test case generation based on formal description

Aiming to improve the Structured Query Language (SQL) injection penetration test accuracy through the formalism-guided test case generation, an attack purpose based attack tree model of SQL injection is proposed, and then under the guidance of this model, the formal descriptions for the SQL injection vulnerability feature and SQL injection attack inputs are established. Moreover, according to new coverage criteria, these models are instantiated and the executable test cases are generated. Experiments show that compared with the random enumerated test case used in other works, the test case generated by our method can detect the SQL injection vulnerability more effectively. Therefore, the false negative is reduced and the test accuracy is improved. Copyright © 2015 by Editorial Board of Journal of Donghua University, Shanghai China.