Security related aspects of databases and database access.

learn more… | top users | synonyms

6
votes
2answers
154 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
0
votes
1answer
58 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
3answers
40 views

Denial of Service by SQL queries - are selective queries better than queries that return a lot?

Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the ...
-1
votes
0answers
37 views

Oracle sql injection [on hold]

Im playing a tournament and have gotten pretty far already. Found a sql injection, blind, oracle 11g database on a windows 64 bit, asp .net based. The user is not dba. The finishing point is ...
0
votes
3answers
70 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
4
votes
1answer
86 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
-8
votes
4answers
133 views

Why shouldn't I store passwords in plaintext? [closed]

Why is it so important not to save passwords in plaintext? I think it is the same issue like authorizing a user on a RESTful webservice, where most developers claim: "Don't send your security token ...
2
votes
5answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
1
vote
0answers
22 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
2
votes
0answers
25 views

Is it a bad practice to not use a separate database server? [duplicate]

An isolated environment for just the application data sounds good, but does it have a significant security advantage compared to the everything-in-one-place model?
34
votes
4answers
5k views

Is using a DB prefix for tables more secure?

I see systems that use database prefixes. Some call it a security feature. Some call it a way to have multiple installations in one database. The main pro is that it's harder to guess the whole table ...
18
votes
6answers
11k views

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
-6
votes
1answer
71 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
3answers
76 views

How many backups should I keep?

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups. ...
0
votes
3answers
66 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
1
vote
0answers
20 views

AWS DMS to use CloudHSM

I have a source database that need to be migrated to another one. This target will be created and integrated with CloudHSM so that the data migrated is encrypted. For migration I am planning to use ...
8
votes
2answers
3k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems. ...
6
votes
2answers
88 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
2
votes
2answers
63 views

Is it safe to reveal table column names in ajax?

I have a table like... THINGS_TABLE ============ thing_key int PRIMARY KEY thing_num varchar(20) thing_title varchar(20) thing_description varchar(20) And ...
1
vote
1answer
90 views

How make SQL select query without comma? [closed]

I am trying SQLi and comma was filtered there. How make SELECT SQL request without a comma?
3
votes
1answer
6k views

Encrypting data within SQLite database in Java - How to store key?

So, a bit of context before I start may be handy. I am developing a Java desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
1
vote
1answer
68 views

Store SHA256 in sql-server

I need to develop a payment gateway and I've just realized I need to store an HMAC_SHA256_V1 key for authentication operations. The way that this is done is: the browser calls a WCF service that ...
2
votes
2answers
65 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
6
votes
3answers
105 views

Is there any concern regarding a database primary key exposure? [duplicate]

Is there any risk if for example I let to end users to know the primary key associated to users in the database?
-1
votes
1answer
30 views

Are they attacks to steal database records from memory in cloud?

Imagine a hosted database in public cloud. Since the database records are encrypted only on disk (data-at-rest). Are they are any attacks that steal the database records from the memory (when queries ...
1
vote
3answers
167 views

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
0
votes
2answers
34 views

How to protect data of users in multi-user site?

I am working on a system where people can make their accounts with few things being stored in database like id (that will be auto increment), first name, last name, username etc. Now I am well aware ...
2
votes
2answers
470 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
3
votes
3answers
45 views

Is there a reason to create a database user without schema privileges?

One of the common things seen people setup is database users (for use by an actual application) that only have SELECT/UPDATE/INSERT/DELETE permissions. A separate user (that additionally has ...
26
votes
3answers
14k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
4
votes
2answers
168 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
15
votes
5answers
20k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
29
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
3
votes
3answers
268 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
0
votes
1answer
71 views

Safest way to access data from an SQL server

I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction ...
2
votes
0answers
61 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
2
votes
2answers
64 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
1
vote
0answers
26 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
1
vote
3answers
54 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
3
votes
1answer
434 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
8
votes
3answers
166 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
5
votes
2answers
950 views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
5
votes
1answer
113 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
1
vote
2answers
108 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
16
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
3
votes
2answers
62 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
5
votes
1answer
300 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
3
votes
0answers
356 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
1answer
396 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...