Enterprise applications commonly use web frameworks and database queries to process user requests, authenticate users, and retrieve application data. OWASP Juice Shop is a deliberately vulnerable web application that can be used to study web application security weaknesses, including SQL Injection.
SQL Injection occurs when an application processes untrusted input in an unsafe manner while constructing database queries. Security protections such as parameterized queries help prevent this vulnerability. However, source-code modifications, incorrect changes to query-handling logic, or the reversal of a security patch may reintroduce a previously fixed vulnerability.
In this use case, OWASP Juice Shop is used as the target application, and source-code versions are compared to identify changes that may weaken SQL Injection protections. A public cybersecurity dataset containing suitable labelled vulnerability-related records is used for machine learning model development and evaluation.
A Support Vector Machine (SVM) classifier is developed using Python and Scikit-learn. Source-code comparison features are extracted using Git, while Semgrep Community Edition (CE) is used to identify potentially unsafe SQL Injection-related code patterns.
Controlled security testing is conducted against the locally deployed application. OWASP ZAP is used to examine application behaviour, and the resulting security findings are compared with the model's predictions. The extracted source-code features must be compatible with the model's training features to ensure meaningful predictions.
The detection workflow also includes dataset preprocessing, model evaluation, security finding verification, and result reporting. A Streamlit dashboard presents classification predictions, evaluation metrics, source-code changes, and security testing findings.
Application/Service: OWASP Juice Shop
OWASP Juice Shop is the target web application used to assess SQL Injection security regressions. Its source code provides the basis for examining how modifications to application logic can affect existing security protections.
Previously fixed SQL Injection vulnerabilities may reappear when source-code modifications weaken or remove existing security controls. Changes to database query construction can introduce unsafe handling of user input, while inadequate patch verification may allow these changes to go undetected.
Traditional static analysis tools identify suspicious code patterns, but their findings do not necessarily establish whether a particular code modification has reintroduced a previously fixed vulnerability. Manual comparison of source-code versions can also make it difficult to identify subtle security regressions.
The proposed solution introduces source-code patch comparison, relevant feature extraction, SVM-based classification, static code analysis, controlled application testing, security finding verification, and post-remediation validation.
Specific Attack: SQL Injection Vulnerability Reintroduction Through Source-Code Patch Reversal or Modification
The controlled attack scenario evaluates whether modifying or reversing a security-related source-code change can reintroduce an SQL Injection vulnerability into the OWASP Juice Shop application.
The objective is to demonstrate how a source-code modification can weaken existing query-handling protections and determine whether the proposed detection workflow identifies the resulting security regression.
Source-Code Security Regression Detection and Machine Learning-Based Classification
The primary security concept is Source-Code Security Regression Detection combined with Machine Learning-Based Classification.
The assessment examines how source-code modifications can weaken existing SQL Injection protections. Git identifies changes between secured and modified source-code versions, while feature extraction prepares relevant code-change characteristics for classification. A Support Vector Machine (SVM) learns patterns from labelled training data and classifies prepared features according to their potential vulnerability risk.
Semgrep CE provides static analysis findings, and OWASP ZAP supports dynamic application testing. These findings help assess the model's predictions. The public dataset must contain suitable labelled records, and the training and prediction features must be compatible. The model's performance on the dataset and its ability to identify regressions in the target application are evaluated separately.
Git compares secured and modified source-code versions to identify changes affecting SQL Injection protections.
Semgrep CE scans source code using applicable SQL Injection detection rules.
The SVM classifier analyses prepared source-code and patch-comparison features using patterns learned from labelled training data.
OWASP ZAP examines the running application through controlled security tests.
The labelled dataset, feature preparation process, training procedure, and model evaluation results are reviewed for consistency.
SVM predictions are compared with Git differences, Semgrep CE findings, and OWASP ZAP results.
Potential vulnerabilities are assessed according to their technical evidence, potential impact, and exploitability.
Unsafe query construction is corrected using appropriate secure query-handling practices, such as parameterized queries where supported.
Source-code analysis and controlled application testing are repeated after corrective changes.
Git is used to maintain source-code versions and compare secured and modified code.
Semgrep CE analyses source code using applicable security rules to identify potentially unsafe SQL Injection-related patterns.
OWASP ZAP assesses the running web application to identify security weaknesses through controlled testing.
Scikit-learn provides the SVM classifier and functions for training, prediction, and model evaluation.
Python integrates the dataset-processing, source-code feature preparation, machine learning, and reporting components.
Pandas and NumPy support dataset manipulation and numerical feature preparation.
A suitable public cybersecurity dataset provides labelled vulnerability-related records for model development and evaluation.
Streamlit provides an interactive dashboard for displaying model predictions and security assessment results.
OWASP Juice Shop provides the web application used for controlled SQL Injection security assessment.
Ubuntu Linux provides the primary development environment for the application, dataset processing, and machine learning workflow.
Kali Linux provides the security-testing environment for controlled application assessment.
Oracle VirtualBox provides the virtualized laboratory environment for the target application and security-testing activities.
Automated Security Regression Classification Implements an SVM-based mechanism to classify prepared source-code features according to their potential SQL Injection regression risk.
Source-Code Change Identification Uses Git to compare secured and modified source-code versions, identifying changes that may weaken previously implemented SQL Injection protections.
Machine Learning Performance Evaluation Evaluates the SVM classifier using accuracy, precision, recall, F1-score, and confusion-matrix analysis to assess its ability to classify security regression risks.
Static Security Analysis Uses Semgrep CE to analyse source code, identify potentially unsafe SQL Injection-related patterns, and highlight suspicious changes requiring further investigation.
Dynamic Application Validation Uses OWASP ZAP to examine OWASP Juice Shop application behaviour and support the verification of suspected SQL Injection vulnerabilities through controlled security testing.
Security Finding Correlation Correlates SVM predictions with Git source-code differences, Semgrep CE findings, and OWASP ZAP results to support the investigation and verification of potential security regressions.
Interactive Security Dashboard Develops a Streamlit dashboard to display machine learning predictions, evaluation metrics, source-code changes, static analysis findings, dynamic testing results, and security assessment status.
Controlled Security Regression Assessment Establishes a repeatable testing workflow to examine secured and modified source-code versions, assess potential SQL Injection regression risks, and verify the effectiveness of existing security protections.
SQL Injection Remediation Verification Repeats source-code comparison, static analysis, and dynamic application testing after corrective changes to determine whether the identified weakness has been addressed.
Security Assessment Documentation Produces structured assessment records containing model evaluation results, identified source-code changes, security-tool findings, validation evidence, remediation status, residual risks, and recommended corrective actions.
Research Breakthrough Possible @S-Logix