Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
0 votes
1 answer
54 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
1 vote
2 answers
157 views

Is it safe to store database credentials as plain text in the configuration file?

Some services like ejabberd, nginx for authenticating using a database, and dovecot requires providing the database password as plain text in the configuration file. Is it safe to store MariaDB ...
whiteman808's user avatar
0 votes
0 answers
52 views

Risk for a public RDS database on AWS

I have a RDS database on a VPC which is public with a password. I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
JVanced's user avatar
1 vote
1 answer
86 views

How to ensure privacy of my codebase while keeping data on client premises?

I have created a data science model pipeline in Python which ingests some data (user transactions) and then runs some models to generate a report. The models that I have created are proprietary and so ...
finstats's user avatar
  • 111
1 vote
2 answers
85 views

Is it safe to keep a JDBC SQLite URI in source code?

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI? Should I replace the name of the SQLite db with code to ...
Setu Kumar Basak's user avatar
0 votes
0 answers
71 views

How much does manually entering a key at process start help?

I have an application that encodes data when writing it to a database, and unencodes it when reading from the database. The encoding is done with a symmetric algorithm using a fixed secret key. I'm ...
M Katz's user avatar
  • 215
0 votes
2 answers
231 views

How much security do DigitalOcean managed databases provide?

DigitalOcean offers managed databases. From what I can understand, the advantages are: You don't have to worry about management tasks such as set-up, updates (including security updates), and backups....
M Katz's user avatar
  • 215
0 votes
0 answers
54 views

Why do most DP mechanisms consider constant noise variance across data points?

I have been studying Differential Privacy (DP) and there’s something I do not understand: why is the variance of the noise in most DP schemes constant across all individuals (assuming a one-to-one ...
synack's user avatar
  • 101
0 votes
2 answers
134 views

Post Exploitation in Oracle web logic server 10.35 (Oracle Linux Server 3.8)

Web Server : Oracle WebLogic 10.35 Machine : Oracle Linux Server 3.8 I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a ...
Abu Bakar's user avatar
2 votes
1 answer
280 views

What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)

There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values. As I proposed a possible solution in a comment to ...
v_slav.b's user avatar
1 vote
1 answer
425 views

What's the difference between dynamic and static parameters in Sqlmap?

What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
fdku's user avatar
  • 11
1 vote
1 answer
124 views

Do web-hosting sites like Heroku or Railway expose your database?

I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the ...
Some Guy's user avatar
  • 115
0 votes
1 answer
131 views

Are there any downsides to publically available encrypted data?

I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
willuhmjs's user avatar
1 vote
1 answer
123 views

Encrypted user data and storing hashed RSA keys on the server for backup reasons

Imagine a mobile app that connects to an API server. Disclaimer I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives. The goal The backend/database super ...
Laisender's user avatar
  • 111
1 vote
1 answer
2k views

AWS RDS Database access from Github Actions

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
Jöcker's user avatar
  • 111
0 votes
0 answers
64 views

Is is bad that on-prem "prod" DB is accessible/visible from in-cloud dev environment?

We have our dev & prod env split between AWS (databricks workspaces) and on-prem Linux boxes. Specifically, we have DB instances on-prem and have python code running inside our databricks ...
Kashyap's user avatar
  • 113
1 vote
1 answer
1k views

How Secure Is It to Use SQLite for Identity Storage in a Web App

I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
Emre Bener's user avatar
2 votes
1 answer
134 views

How to make sure that your backups are not encrypted?

Say a ransomware encrypts your database but hides the fact (by secretly decrypting everything you ask for). Then your backups become rubbish once the attacker deletes the key. What are good measures ...
J Fabian Meier's user avatar
1 vote
1 answer
749 views

What are these http requests trying to break?

I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
ConfusedHost's user avatar
1 vote
2 answers
588 views

Malware prevention of data received in a POST endpoint

Problem Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental? To consider (please read) POST data receives ...
Federico Baù's user avatar
3 votes
1 answer
246 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
SERO9's user avatar
  • 31
6 votes
2 answers
4k views

Should user credentials and user info be stored in seperate tables?

Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)? My main concern is that I'll be sending other user's information (...
user avatar
1 vote
2 answers
380 views

Using one server and user database for multiple websites

Goal I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
Mike V.'s user avatar
  • 11
1 vote
1 answer
82 views

Is there a security benefit to keeping data in separate tables?

Sorry if this is naïve , but the recent data leaks in Australia have me wondering. Question have been asked of Optus in particular (a local Telco) whether they really should have hung on to identity ...
Manngo's user avatar
  • 141
1 vote
1 answer
122 views

Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?

For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
galadriel34's user avatar
2 votes
1 answer
579 views

Is encryption with MySQL Aes_encrypt() + stored procedure ok?

I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database. Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
Poubelle Dirty's user avatar
1 vote
0 answers
288 views

MySQL encrypt fields and decrypt them with a password

I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password. So let's say I've got user X that stores something ...
Yamile's user avatar
  • 11
1 vote
2 answers
117 views

How can an attacker cryptolock a database content after having compromised the application server, which protection to setup?

I have an application server accessible from the Web, behind a reverse proxy. Its database is secured on a separate VLAN and the database admin password is strong. Say the application or the operating ...
lalebarde's user avatar
  • 617
3 votes
2 answers
523 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
Alexander's user avatar
1 vote
2 answers
206 views

Ports open on jump server in CDE

We placed a jump server in CDE to restrict the direct access to PCI in-scope devices (although I believe it should be outside CDE, please confirm) Now, we have opened SQL ports 1433 and application ...
user30026's user avatar
0 votes
1 answer
150 views

Site "can't" change username, why? [closed]

There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
Thomas's user avatar
  • 1
1 vote
1 answer
165 views

The server acts as a database server , but there is no open port regarding that why?

I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities. The server does multiple functionalities, It acts as a web ...
Kumar's user avatar
  • 41
25 votes
6 answers
9k views

Is a sha256 hash of a unix timestamp a strong password

I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
ThisGuyCantEven's user avatar
2 votes
1 answer
527 views

Best practice to encrypt data on smartphone

What is best practice for the encryption of offline application data? I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
Donatic's user avatar
  • 121
1 vote
2 answers
90 views

Trustless Application Architecture for end-users with secure enclaves

I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
vin42tau's user avatar
0 votes
2 answers
159 views

What are best practices for finding an account in a SQL database during authentication? Is using `LIMIT 1` vulnerable to timing attacks?

I have a application where users can log in by providing a username or email address (both case insensitive) and a password. In the users table in the database, the relevant account information is ...
limitone's user avatar
0 votes
0 answers
61 views

Is there much practical security value in using passwords/usernames for postgres instances used on development machines?

So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
Jack Kinsella's user avatar
23 votes
12 answers
8k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
BinarSkugga's user avatar
3 votes
0 answers
1k views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
Waristea's user avatar
2 votes
3 answers
177 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
12345's user avatar
  • 23
3 votes
1 answer
463 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
watchowl's user avatar
  • 5,458
2 votes
0 answers
177 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
Struggler's user avatar
2 votes
2 answers
575 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
0 votes
2 answers
109 views

Is it possible to compromise a device by connecting to a database?

I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL) I'm wondering if it's possible that my secure device ...
Trevor Wood's user avatar
1 vote
0 answers
214 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
NicholaiRen's user avatar
0 votes
2 answers
235 views

How to be sure there are only encrypted data on my backend

I am coding an online password manager as part of my apprenticeship. I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
Estéban Ristich's user avatar
0 votes
0 answers
146 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
N S's user avatar
  • 41
1 vote
2 answers
588 views

How to control authorized access to specific data for specific users

I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
Aplex's user avatar
  • 11
2 votes
0 answers
124 views

Database Security for Public Databases

I recently moved some of my projects over a to serverless platform. I immediately noticed a few issues though. The biggest being database security. Prior to this I had been hosting my sites and ...
cyw's user avatar
  • 121
0 votes
1 answer
182 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
azoundria's user avatar
  • 753

1
2 3 4 5
16