Security related aspects of databases and database access.

learn more… | top users | synonyms

4
votes
2answers
70 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
1
vote
1answer
35 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
15
votes
5answers
18k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
29
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
3
votes
3answers
182 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
0
votes
1answer
50 views

Safest way to access data from an SQL server

I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction ...
-4
votes
0answers
50 views

What is most secure web framework for a secure website? [closed]

What is most secure web framework for a secure website? Give me the best tips for a server and framework configuration: OS name-version, webserver, database, php. And tips for securing it. Thank you ...
2
votes
0answers
59 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
2
votes
2answers
30 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
1
vote
0answers
25 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
6
votes
2answers
119 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
1
vote
3answers
48 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
3
votes
1answer
308 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
8
votes
3answers
141 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
4
votes
2answers
856 views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
5
votes
1answer
81 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
1
vote
2answers
86 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
16
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
3
votes
2answers
38 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
5
votes
1answer
294 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
3
votes
0answers
340 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
1answer
136 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
3
votes
1answer
111 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
1
vote
2answers
146 views

Benefit of randomly generated column names?

Would it be of any benefit to have tables with randomly generated names? For example: An SQL injection might be looking for: SELECT * FROM users WHERE 1=1 But if users is really rifchodafsnhe (or ...
-1
votes
1answer
37 views

What is resource isolation for Database security

Does resource isolation mean different users are assigned different resources such as memory and processors as their own resources? How such resource isolation improve database security? Can you ...
50
votes
13answers
6k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
2
votes
1answer
36 views

mandatory access control for database security

For mandatory access control, the following rules, due to Bell and La Padula, are imposed: User i can retrieve object j only if the clearance level of i is greater than or equal to the ...
3
votes
1answer
50 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
1
vote
1answer
126 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
0
votes
1answer
48 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
0
votes
1answer
53 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
0
votes
1answer
39 views

Two classes of discretionary protection

I am reading security chapter of book titled Introduction to database system. It said that discretionary protection can be divided into two subclasses c1 and c2. Class c1 distinguishes between ...
1
vote
1answer
141 views

Decoding base64 encoded message with a key [closed]

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in database a field called ...
1
vote
2answers
115 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
3
votes
2answers
92 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
2
votes
1answer
746 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
0
votes
1answer
62 views

Does creation of dump data would be considered as vulnerablity?

Problem behind the question : We were a small firm developing a small web application which was similar to fb,gmail,etc [in terms of functionality]. We have a signup form and I was assigned to test ...
0
votes
1answer
37 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
10
votes
3answers
2k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
3
votes
1answer
229 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
1
vote
2answers
225 views

How to keep database record secret even from developer having access to it?

Imagine a web-based email app, such as GMail. The email should only be readable by the sender and the recipients. No one else, including the developer having access to the database server or ...
-1
votes
1answer
311 views

What is one way to verify emails of compromised website if registrations are not validated?

There was recently a massive personal data leak, and the data seems to be from Ashley Madison - a site providing dating services to married men. The site takes any email and does not verify them while ...
0
votes
0answers
58 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
1
vote
2answers
66 views

Why use the UUID method over traditional ID?

The following quote came from one of my Teachers not to long ago, along with an exercise to build an application: To follow guidelines, you are to use UUID's instead of ID's. Of course, the ...
1
vote
0answers
70 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
2
votes
2answers
377 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
3
votes
2answers
148 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
2
votes
1answer
73 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
2
votes
2answers
103 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...