安全工程师和渗透测试人员可以借鉴RADAGAS和RefleXQLi的思路，自动化生成对抗性SQL注入payload来评估自家WAF的盲区，尤其是AI/ML型WAF的脆弱点值得重点关注。
该论文提出两种基于大语言模型（LLM）的对抗性SQL注入生成系统：RADAGAS（检索增强生成）和RefleXQLi（反思链式推理），用于自动化测试Web应用防火墙（WAF）的防御能力。研究使用GPT-4o、Claude 3.7 Sonnet和DeepSeek R1，在10种WAF（包括规则型、AI/ML型和商业型）上进行了240次实验，生成了24万个payload并执行了220万次测试。结果显示，RADAGAS-GPT4o以22.73%的绕过率领先基线模型，对AI/ML型WAF（如WAF-Brain和CNN-WAF）的绕过率高达92.49%和80.48%，但对规则型WAF（如ModSecurity和Coraza）的绕过率仅0-5.70%。研究还发现，多样性较低的payload更容易绕过，但若初始payload失败则效果不佳。这项工作为安全测试中LLM的应用提供了全面视角。
Adversarial SQL Injection Generation with LLM-Based Architectures
SQL injection (SQLi) attacks are still one of the serious attacks ranked in the Open Worldwide Application Security Project (OWASP) Top 10 threats. Today, with advances in Artificial Intelligence (AI), especially in Large Language Models (LLMs), an opportunity has been created for automating adversarial attack tests to measure the defense mechanisms. In this paper, we aim to create a comprehensive evaluation of use cases that utilize LLMs for adversarial SQL injection generation. We introduce two novel LLM-based systems, Retrieval Augmented Generation for Adversarial SQLi (RADAGAS) and Reflective Chain-of-Thought SQLi (RefleXQLi), and compare them with existing baselines against 10 Web Application Firewalls (WAFs) and one execution-based MySQL validator. To perform a comprehensive test, we used six rule-based open-source WAFs (ModSecurity PL1--3, Coraza PL1--3), 2 AI/ML-based WAFs (WAF Brain, CNN-WAF), and 2 commercial WAFs (AWS WAF and Cloudflare WAF). For the LLM models, we used GPT-4o, Claude 3.7 Sonnet, and DeepSeek R1. Our tests consist of 240 experiments that generate 240,000 payloads and perform 2.2 million tests against WAFs. Our comprehensive evaluation reveals that RADAGAS-GPT4o outperforms other baseline models with a 22.73\% bypass rate. The proposed RADAGAS variants are highly successful on AI/ML-based WAFs (92.49\% on WAF-Brain by RADAGAS-DeepSeek, 80.48\% on CNN-WAF by RADAGAS-Claude), but struggle to bypass rule-based WAFs (0--5.70\% on ModSecurity and Coraza). In addition to these findings, another observation is that creating less diverse payloads achieves more bypasses, however they show poor results if the initially chosen payload is not successful. We observe that our findings provide a comprehensive view on using LLM-based approaches in security testing.