## 3 Background
### SQL Injection Attacks  
SQL injection (SQLi) attacks are a type of security vulnerability that occurs when an attacker manipulates SQL queries executed by a web application [2]. These attacks exploit improper handling of user inputs in SQL statements, allowing attackers to access, modify, or delete sensitive database information. Common attack vectors include login forms, search fields, and URL parameters. Figure 1 illustrates the operational mechanism of a SQL injection attack. As a simple illustrative example, consider a web application with a login form where users enter their username and password. The backend code might construct an SQL query like this:SELECT * FROM users WHERE username = 'user_input' AND password ='password_input'; ```
If the application does not properly sanitize user inputs, an attacker could input the following in the username field:  
' OR '1' = '1  
This modifies the query to:
``` SELECT * FROM users WHERE username = 'OR '1' = '1' --'AND password = '1'; ```  
The - - marks the rest of the query as a comment, so everything after it is ignored. Since '1' = '1' is always true, the query retrieves all rows from the users table. SQLi attacks today are far more complex. SQLi attacks can be broadly categorized based on the techniques used [2]. In this paper, we focus on the following types of SQLi attacks: **Conditional attacks** use payloads that manipulate query conditions to infer database information by observing changes in the application's behavior. **Error-based attacks** exploit error messages returned by the database to extract details about its structure or configuration. **Tautology attacks** involve injecting always-true conditions (e.g., 1 = 1) into queries to bypass authentication or retrieve unintended data. **Tautology and conditional attacks** combine these techniques, using tautologies to identify vulnerable points and conditions to refine the extraction of specific information. **Exist-based attacks** rely on verifying the existence of certain data or tables in the database through crafted payloads, often by leveraging subtle response differences. In addition to the above attacks, other attack types include the following--**Union-based attacks** use the UNION operator to merge legitimate query results with attacker-crafted data, allowing data retrieval from other tables. **Inferential attacks** (Blind SQLi) rely on deducing database information indirectly through application responses or execution delays, without receiving direct query results. **Time-based attacks**, a subset of Blind SQLi, inject queries that trigger delays to infer true/false conditions. **Out-of-band attacks** exploit alternative communication channels, such as DNS or HTTP, for data exfiltration, often useful when traditional channels are unavailable. **Stored attacks** involve inserting malicious payloads into a database, which executes later when accessed, making it particularly dangerous in shared or dynamic environments. **Second-order attacks** embed payloads that are stored and later executed in a different context within the application, often bypassing traditional input sanitization. Obfuscation in SQL Injection Attacks  
Obfuscation refers to techniques used by attackers to disguise or modify malicious SQLi payloads in order to evade detection by security mechanisms such as Web Application Firewalls (WAFs), Intrusion Detection Systems (IDSs), or input validation filters [20]. Figure 1: Anatomy of an SQL injection attack. Existing methods update WAF security rules manually in response to attacks. GenSQLi automates the generation of SQLi attacks and corresponding WAF security rules, enhancing security systems against SQLi threats. By altering the appearance of SQLi payloads without changing their functionality, attackers aim to bypass pattern-based defenses or heuristic checks. Some common obfuscation techniques include the following--**Encoding and escaping** involves using character encoding schemes like URL encoding, hexadecimal, or Unicode to mask malicious inputs.