Questions tagged [databases]
Security related aspects of databases and database access.
752
questions
0
votes
1
answer
54
views
OAuth2: Storing temp values in session vs database
I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
1
vote
2
answers
157
views
Is it safe to store database credentials as plain text in the configuration file?
Some services like ejabberd, nginx for authenticating using a database, and dovecot requires providing the database password as plain text in the configuration file. Is it safe to store MariaDB ...
0
votes
0
answers
52
views
Risk for a public RDS database on AWS
I have a RDS database on a VPC which is public with a password.
I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
1
vote
1
answer
86
views
How to ensure privacy of my codebase while keeping data on client premises?
I have created a data science model pipeline in Python which ingests some data (user transactions) and then runs some models to generate a report. The models that I have created are proprietary and so ...
1
vote
2
answers
85
views
Is it safe to keep a JDBC SQLite URI in source code?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with code to ...
0
votes
0
answers
71
views
How much does manually entering a key at process start help?
I have an application that encodes data when writing it to a database, and unencodes it when reading from the database. The encoding is done with a symmetric algorithm using a fixed secret key.
I'm ...
0
votes
2
answers
231
views
How much security do DigitalOcean managed databases provide?
DigitalOcean offers managed databases. From what I can understand, the advantages are:
You don't have to worry about management tasks such as set-up, updates (including security updates), and backups....
0
votes
0
answers
54
views
Why do most DP mechanisms consider constant noise variance across data points?
I have been studying Differential Privacy (DP) and there’s something I do not understand: why is the variance of the noise in most DP schemes constant across all individuals (assuming a one-to-one ...
0
votes
2
answers
134
views
Post Exploitation in Oracle web logic server 10.35 (Oracle Linux Server 3.8)
Web Server : Oracle WebLogic 10.35
Machine : Oracle Linux Server 3.8
I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a ...
2
votes
1
answer
280
views
What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)
There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values.
As I proposed a possible solution in a comment to ...
1
vote
1
answer
425
views
What's the difference between dynamic and static parameters in Sqlmap?
What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
1
vote
1
answer
124
views
Do web-hosting sites like Heroku or Railway expose your database?
I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the ...
0
votes
1
answer
131
views
Are there any downsides to publically available encrypted data?
I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
1
vote
1
answer
123
views
Encrypted user data and storing hashed RSA keys on the server for backup reasons
Imagine a mobile app that connects to an API server.
Disclaimer
I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives.
The goal
The backend/database super ...
1
vote
1
answer
2k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
0
votes
0
answers
64
views
Is is bad that on-prem "prod" DB is accessible/visible from in-cloud dev environment?
We have our dev & prod env split between AWS (databricks workspaces) and on-prem Linux boxes. Specifically, we have DB instances on-prem and have python code running inside our databricks ...
1
vote
1
answer
1k
views
How Secure Is It to Use SQLite for Identity Storage in a Web App
I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
2
votes
1
answer
134
views
How to make sure that your backups are not encrypted?
Say a ransomware encrypts your database but hides the fact (by secretly decrypting everything you ask for). Then your backups become rubbish once the attacker deletes the key.
What are good measures ...
1
vote
1
answer
749
views
What are these http requests trying to break?
I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
1
vote
2
answers
588
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
3
votes
1
answer
246
views
How to design a desktop application that has access to a database via LAN?
As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
6
votes
2
answers
4k
views
Should user credentials and user info be stored in seperate tables?
Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)?
My main concern is that I'll be sending other user's information (...
1
vote
2
answers
380
views
Using one server and user database for multiple websites
Goal
I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
1
vote
1
answer
82
views
Is there a security benefit to keeping data in separate tables?
Sorry if this is naïve , but the recent data leaks in Australia have me wondering.
Question have been asked of Optus in particular (a local Telco) whether they really should have hung on to identity ...
1
vote
1
answer
122
views
Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?
For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
2
votes
1
answer
579
views
Is encryption with MySQL Aes_encrypt() + stored procedure ok?
I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database.
Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
1
vote
0
answers
288
views
MySQL encrypt fields and decrypt them with a password
I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password.
So let's say I've got user X that stores something ...
1
vote
2
answers
117
views
How can an attacker cryptolock a database content after having compromised the application server, which protection to setup?
I have an application server accessible from the Web, behind a reverse proxy. Its database is secured on a separate VLAN and the database admin password is strong.
Say the application or the operating ...
3
votes
2
answers
523
views
Is it a good idea to reuse certificate issued by public CA for internal database client authentication?
Let's say we have:
Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
1
vote
2
answers
206
views
Ports open on jump server in CDE
We placed a jump server in CDE to restrict the direct access to PCI in-scope devices (although I believe it should be outside CDE, please confirm)
Now, we have opened SQL ports 1433 and application ...
0
votes
1
answer
150
views
Site "can't" change username, why? [closed]
There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
1
vote
1
answer
165
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
2
votes
1
answer
527
views
Best practice to encrypt data on smartphone
What is best practice for the encryption of offline application data?
I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
1
vote
2
answers
90
views
Trustless Application Architecture for end-users with secure enclaves
I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
0
votes
2
answers
159
views
What are best practices for finding an account in a SQL database during authentication? Is using `LIMIT 1` vulnerable to timing attacks?
I have a application where users can log in by providing a username or email address (both case insensitive) and a password. In the users table in the database, the relevant account information is ...
0
votes
0
answers
61
views
Is there much practical security value in using passwords/usernames for postgres instances used on development machines?
So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
23
votes
12
answers
8k
views
Storing weakness level of passwords
I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
3
votes
0
answers
1k
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
2
votes
3
answers
177
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
3
votes
1
answer
463
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
2
votes
0
answers
177
views
Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]
I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password.
The ...
2
votes
2
answers
575
views
Multiple user sessions at the same time in a backoffice
I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management.
The practice already has a backoffice-style software, but it's ...
0
votes
2
answers
109
views
Is it possible to compromise a device by connecting to a database?
I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL)
I'm wondering if it's possible that my secure device ...
1
vote
0
answers
214
views
How should SQL Server users be managed for a multi-tenant application?
I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly.
I have a SQL Server that will be used to store data for a multi-tenant application. ...
0
votes
2
answers
235
views
How to be sure there are only encrypted data on my backend
I am coding an online password manager as part of my apprenticeship.
I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
0
votes
0
answers
146
views
Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?
Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
1
vote
2
answers
588
views
How to control authorized access to specific data for specific users
I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
2
votes
0
answers
124
views
Database Security for Public Databases
I recently moved some of my projects over a to serverless platform. I immediately noticed a few issues though. The biggest being database security.
Prior to this I had been hosting my sites and ...
0
votes
1
answer
182
views
Getting Smaller Output From Public Key Cryptography In PHP
I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...