CAJ | 학술논문

由于Web应用系统的开发周期较短，同时开发人员安全编程意识不足，Web应用程序会存在漏洞。因此，检测Web应用系统的安全性是安全领域的亟待解决的问题。SQL注入漏洞检测工具模拟黑客攻击的方式，采用网络爬虫技术建立需检测的URL库，依据SQL注入模板精心构造URL，并从根据浏览器返回信息，判定是否存在SQL注入点。可以提前意识到Web应用存在的漏洞，并及时修补，降低系统受攻击的风险，是有效的Web安全防护手段。
유우Web응용계통적개발주기교단，동시개발인원안전편정의식불족，Web응용정서회존재루동。인차，검측Web응용계통적안전성시안전영역적극대해결적문제。SQL주입루동검측공구모의흑객공격적방식，채용망락파충기술건립수검측적URL고，의거SQL주입모판정심구조URL，병종근거류람기반회신식，판정시부존재SQL주입점。가이제전의식도Web응용존재적루동，병급시수보，강저계통수공격적풍험，시유효적Web안전방호수단。
Web application development cycle is very short, and programmers lack the awareness of security programming, loopholes in Web applications are inevitable. So how to detect and assess security of Web applications is a serious problem of Web security. SQL Injection Detection System simulates the way that hacker at acks to send specific vulnerability characteristics. This tool can create URL library using the web crawler technology, and construct URL careful y based on SQL injection template. According to the response of browser, determine the existence of SQL injection. Users can aware of Web application vulnerabilities early, and repair them timely. As a result the risk of at ack system is reduced and it is the ef ective method to protect Web security.