Security related aspects of databases and database access.

learn more… | top users | synonyms

1
vote
1answer
27 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
4
votes
2answers
65 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
0
votes
1answer
49 views

Safest way to access data from an SQL server

I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction ...
3
votes
3answers
180 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
-4
votes
0answers
49 views

What is most secure web framework for a secure website? [closed]

What is most secure web framework for a secure website? Give me the best tips for a server and framework configuration: OS name-version, webserver, database, php. And tips for securing it. Thank you ...
2
votes
0answers
59 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
2
votes
2answers
30 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
1
vote
0answers
25 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
1
vote
3answers
47 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
1
vote
2answers
85 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
8
votes
3answers
141 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
16
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
3
votes
2answers
36 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
5
votes
1answer
294 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
3
votes
0answers
339 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
1answer
133 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
5
votes
1answer
81 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
1
vote
2answers
146 views

Benefit of randomly generated column names?

Would it be of any benefit to have tables with randomly generated names? For example: An SQL injection might be looking for: SELECT * FROM users WHERE 1=1 But if users is really rifchodafsnhe (or ...
3
votes
1answer
50 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
50
votes
13answers
6k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
2
votes
1answer
36 views

mandatory access control for database security

For mandatory access control, the following rules, due to Bell and La Padula, are imposed: User i can retrieve object j only if the clearance level of i is greater than or equal to the ...
0
votes
1answer
53 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
0
votes
1answer
39 views

Two classes of discretionary protection

I am reading security chapter of book titled Introduction to database system. It said that discretionary protection can be divided into two subclasses c1 and c2. Class c1 distinguishes between ...
-1
votes
1answer
36 views

What is resource isolation for Database security

Does resource isolation mean different users are assigned different resources such as memory and processors as their own resources? How such resource isolation improve database security? Can you ...
1
vote
1answer
141 views

Decoding base64 encoded message with a key [closed]

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in database a field called ...
1
vote
2answers
115 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
3
votes
2answers
91 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
0
votes
1answer
62 views

Does creation of dump data would be considered as vulnerablity?

Problem behind the question : We were a small firm developing a small web application which was similar to fb,gmail,etc [in terms of functionality]. We have a signup form and I was assigned to test ...
0
votes
1answer
37 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
3
votes
1answer
304 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
0
votes
0answers
58 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
1
vote
2answers
66 views

Why use the UUID method over traditional ID?

The following quote came from one of my Teachers not to long ago, along with an exercise to build an application: To follow guidelines, you are to use UUID's instead of ID's. Of course, the ...
1
vote
0answers
70 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
2
votes
1answer
73 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
2
votes
2answers
103 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
6
votes
2answers
119 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
1
vote
2answers
75 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
0
votes
1answer
48 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
1
vote
1answer
86 views

what fields should I encrypt in a database containing user information? [closed]

So in a database many user fields could exist. Normally when I setup a database I go off of the security experts recommendations on what fields to encrypt, but I'm curious what is the most standard ...
4
votes
1answer
140 views

How do banking software systems securely store account information in database?

Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of ...
2
votes
3answers
258 views

Is it possible to make cracking a password pointless to an attacker with database access?

I've been reading information on making passwords secure, but what are the reasons an attacker would want to put effort into getting the original password? If an attacker does indeed have a copy of ...
2
votes
3answers
466 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
3
votes
1answer
111 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
2
votes
3answers
149 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
0
votes
1answer
50 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
-1
votes
1answer
208 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
3
votes
1answer
79 views

Best practice for direct SQL connection from DB to specific IPs on Internet

I am using AWS and looking for any comments on best practices regarding permitting connections to my DB from specific IPs on the Internet. I could give the DB a public IP and just lock down the ...
-1
votes
1answer
311 views

What is one way to verify emails of compromised website if registrations are not validated?

There was recently a massive personal data leak, and the data seems to be from Ashley Madison - a site providing dating services to married men. The site takes any email and does not verify them while ...
0
votes
0answers
23 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...