Adversary Simulation of Structured Query Language (SQL) Injection Attack Using Genetic Algorithm for Web Application Firewalls (WAF) Bypass

This research proposed adversary simulation for Structured Query Language (SQL) injection attacks using the genetic algorithm to bypass Web Application Firewalls (WAF). SQL Injection is a cyberattack that exploits the weakness of web applications to access data in the database illegally. WAF is one of the security systems used to protect web applications from SQL injection. WAF is a security system that is easy to integrate with the web server, has a minimal cost, and is easy to configure. SQL injection commonly uses a fuzzing method to attack web applications, but this method is ineffective in bypassing WAF. However, attackers develop SQL injection to exploit vulnerabilities in a web application. This attack is also effective in bypassing WAF. Therefore, this research proposed adversary simulation to take a lesson learned from SQL injection attacks using a genetic algorithm. The lesson learned can be used as a detection strategy against SQL injection attacks using genetic algorithms. This research simulates the attack on some familiar environments in web application testing frameworks and WAF products. Based on the simulation result, the genetic algorithm has a high number of total payload successes in processing SQL injection compared to traditional fuzzing and Cartesian product method.