Implementação e avaliação de técnicas avançadas para a prevenção de ataques SQLi em aplicações web

Abstract

As technology advances and dependence on web applications increases in various segments of today's society, where commercial, social and government transactions can be carried out online through web applications, these applications deal with an immense amount of data, much of which are confidential and sensitive. Even with the advancement of technologies, there is still a large number of SQL injection attacks (SQLi), in which attackers exploit flaws in the way applications handle user input to manipulate database queries, obtaining unauthorized access of confidential data or carrying out harmful actions. This work focused on analyzing the processes involved in preventing SQLi. Security tests were divided into two groups: preventive and prevention. The preventive group, which uses the SAST technique, aims to passively prevent attacks by identifying vulnerabilities in the code. The prevention group, which uses SIEM and WAF techniques, actively counterattacks, analyzing and interrupting them. As a result, all techniques proved to be effective, but the SIEM technique, with the Trend Vision One tool, stood out for its ease of implementation and effectiveness in detecting and stopping attacks in real time. While significant progress has been made in detecting and preventing SQLi attacks, combining existing techniques and developing new tools and methods can lead to more efficient and sophisticated prevention of these attacks.