An Analytical Scanning Technique to Detect and Prevent the Transformed SQL Injection and XSS Attacks

Among the most critical and dangerous attacks is the one that exploits Base64 or Hex encoding technique in SQL Injection (SQLIA) and Cross Site Scripting (XSS) attacks, instead of using plain text. This technique is widely used in most dangerous attacks because it evades detection. Therefore, it is possible to bypass many filters such as IDS, without taking into account the transformation methodologies of the symbols and characters. Moreover, it reserves the same semantics with different syntax. Attackers can exploit this serious technique to reach unseen data and gain valuable benefits. To the best of our knowledge, this paper presents the first technique that focuses on detecting and preventing transformed SQLIA and XSS from Base64 and Hex encoding. We perform scanning and analyzing methods by targeting two places: (i) Input boxes and (ii) Strings in page URLs. Then, we decode the inputs and compare them with our stored suspicious tokens. Finally, we perform string matching and mutation mechanisms to revoke the activity of malicious inputs. We have evaluated our technique and the results showed that it is capable to detect and prevent this transformed attack.