Web security scanners are used to discover SQL injection
vulnerabilities in deployed web applications. Scanners tend
to use static rules to cover the most common injection cases,
missing diversity in their payloads, leading to a high volume
of requests and false negatives. Moreover, scanners often
rely on the presence of error messages or other significant
feedback on the target web pages, as a result of additional
insecure programming practices by web developers.
In this paper we develop SQIRL, a novel approach to detecting SQL injection vulnerabilities based on deep reinforcement
learning, using multiple worker agents and grey-box feedback.
Each worker intelligently fuzzes the input fields discovered
by an automated crawling component. This approach generates a more varied set of payloads than existing scanners,
leading to the discovery of more vulnerabilities. Moreover,
SQIRL attempts fewer payloads, because they are generated
in a targeted fashion.
SQIRL finds all vulnerabilities in our microbenchmark for
SQL injection, with substantially fewer requests than most
of the state-of-the-art scanners compared with. It also significantly outperforms other scanners on a set of 14 production
grade web applications, discovering 33 vulnerabilities, with
zero false positives. We have responsibly disclosed 22 novel
vulnerabilities found by SQIRL, grouped in 6 CVEs.