1
vote
1answer
67 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
2
votes
2answers
316 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
9
votes
4answers
494 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...