Evaluating Large Language Models Versus Traditional Tools in SQL Injection Exploit Generation

SQL injection (SQLi) remains a critical threat to database security, as it exploits vulnerabilities that allow unauthorized access to or manipulation of database systems. Traditional tools like SQLmap are commonly used for vulnerability testing but often lack adaptability and efficiency in complex database environments. This research examines the potential of generative artificial intelligence to improve SQLi payload generation, specifically through a fine-tuned models of ChatGPT 3.5 Turbo by OpenAI and Command R by Cohere.The study began by using SQLmap to generate 1,136 SQLi payloads, which achieved a success rate of 6.51% in bypassing authentication and extracting data from a MySQL database. These payloads were then used to fine-tune Command R and ChatGPT 3.5 Turbo models, which subsequently generated 1,007 and 1,004 new payloads, respectively. The effectiveness of these payloads was tested using Burp Suite, a proxy software, targeting the OWASP Mutillidae II testbed. This involved setting parameters for username and password fields in the Burp Suite Intruder to launch attacks, resulting in ChatGPT 3.5 Turbo proved to be around 60% more effective than Command R and nearly 75% better than SQLmap. Furthermore, Command R was about 130% more effective than SQLmap.