Flask-based SQL Injection Detection API

Notes

Tested on Fedora Silverblue

Description

This webserver is designed to detect SQL injection attempts in provided queries. It uses a trained Random Forest model to classify queries as malicious or not. The server is built with Quart, a Python ASGI web microframework, and Hypercorn, an ASGI server. Sample data is based on SQL Injection Dataset by SAJID576 on Kaggle.

Endpoints

POST /detect

This endpoint accepts a JSON object with a query field. It returns a JSON object with a is_malicious field indicating whether the provided query is considered malicious.

Request:

{
    "query": "SELECT * FROM users"
}

Response:

{
    "is_malicious": false
}

POST /upload_csv

This endpoint accepts a CSV file for retraining the model. The CSV file should be included in the file field of the form data. A password field should also be included in the form data for authentication. The server will return a message indicating whether the file was saved successfully and the model training has started.

Form Data:

• file: The CSV file
• password: The password for authentication

Response:

{
    "message": "File saved and model training started"
}

GET /healthcheck

This endpoint returns the status of the server and the training process. It returns a JSON object with a status field indicating the status of the server and a training field indicating the status of the training process.

Response:

{
    "message": "System is operational. Please POST to /detect with 'query' to use the service.",
    "status": "ok",
    "training": "idle"
}

Environment Variables

• MODEL_URL: Specify a URL to a model file to load. If not specified, the server will train a new model.
• VECTORIZER_URL: Specify a URL to a vectorizer file to load. If not specified, the server will create vectorizer when training a new model.
• ALLOW_TRAINING: Specify whether to allow training via the /upload_csv endpoint. If not specified, the default is False.
• SECRET_TRAIN_PASSKEY: Specify a password for the training endpoint. If not specified, the default password is 1234.

Requirements

• Docker
• Docker-compose
• Python 3.8
• python3-pip
• conda
• python3-virtualenv

Docker Method (Recommended)

Please note, the Docker-compose file is required, and this project cannot be ran via docker run due to the need for volume mount and port mapping.

Deploy from Docker Hub

Note

Make sure you have Docker installed

1. Save the docker-compose.yaml file from this project to your local machine.
2. Create/edit .env file based on the contents in the .env.example file.:
3. Create the container with sudo docker-compose up, or add -d to run in background.

Building from Source

Note

Make sure you have Docker installed

1. Clone the repository with git clone https://github.com/PhysCorp/SQL-Detect.git and navigate to the project directory with cd SQL-Detect.
2. Create/edit .env file based on the contents in the .env.example file.:
3. Build the Docker image with sudo docker-compose build.
4. Run the Docker image in foreground with sudo docker-compose up, or add -d to run in background.

Manual Method

Installation

1. Install python3, python3-pip and anaconda. Anaconda can be retrieved from here. If you are on Windows, you can install anaconda with chocolatey using choco install anaconda3.
2. Create a conda environment with conda create --name SQL-Detect python=3.8.
3. Activate the conda environment with conda activate SQL-Detect.
4. Install the requirements with python3 -m pip install -r requirements.txt.
5. (Optional): Reinstall charset-normalizer if experiencing issues with COMMON_SAFE_ASCII_CHARACTERS python3 -m pip install --force-reinstall charset-normalizer

Usage

0. Download this project with git clone https://github.com/PhysCorp/SQL-Detect.git and navigate to the project directory with cd SQL-Detect.
1. Activate the conda environment with conda activate SQL-Detect.
2. Create/edit .env file based on the contents in the .env.example file.
3. Run python3 main.py to start the application.

Alternate Instructions using virtualenv (Linux & MacOS, Windows mileage may vary)

Create a new virtualenv with python3 -m venv .venv. Activate the virtualenv with source .venv/bin/activate. Install the requirements with python3 -m pip install -r requirements.txt.

Uninstall Conda Environment

1. Deactivate the conda environment with conda deactivate.
2. Remove the conda environment with conda remove --name SQL-Detect --all.

License

Copyright 2024 | This project is licensed under the MIT License. The full license can be found in the GitHub repository.