Security related aspects of databases and database access.

learn more… | top users | synonyms (1)

0
votes
0answers
6 views

Knowledge base solution access

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
1
vote
1answer
14 views

How secure is it to use ODBC Driver with SSL

When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server. It is ...
0
votes
1answer
29 views

Is it possible using a file level encryption in addition to TDE in Microsoft SharePoint?

For Microsoft SharePoint, TDE is a great encryption solution to keep databases encrypted. I've tried to find a possible solution to encrypt the files once more using an other level of encryption on ...
0
votes
3answers
92 views

Understanding a DMZ with multiple servers

I get the general principle of a DMZ i.e. place public facing servers in the DMZ to isolate and protect the corporate LAN. I have a web application which is to be public facing, this web app needs to ...
0
votes
2answers
124 views

Weird table names in SQLite database

This is the first time I'm using sqlmap against SQLite. When I run: sqlmap -u www.site.com:80/index.php?vulnParametr=p --dump-all --keep-alive --dbms=sqlite It gives me this: What is that? Is ...
1
vote
0answers
296 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
11
votes
3answers
3k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
-4
votes
0answers
11 views

External email from specific database going to junk folder [migrated]

I have migrated from Exchange 2010 to Exchange 2013, after which things are okay. I have four server plus two databases as below: Servers: CAS01, CAS02, MBX01, MBX02 Database: DB1 mounted on MBX01 ...
3
votes
1answer
44 views

Are there open databases or sites similar to xssed.com, not necessarily about XSS?

Are there open databases, websites similar to xssed.com that are not necessarily about XSS, but where people report SQL inject-able websites or malware infected websites, for example? Potentially ...
1
vote
1answer
53 views

How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...
0
votes
1answer
161 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
4
votes
2answers
3k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
0
votes
4answers
3k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
0
votes
0answers
20 views

Using Nginx to block non-GET requests

I'm running a CouchDB instance on my server. A certain database within it (not the entire CouchDB instance) is exposed at a subdomain on my website via this Nginx configuration: server { listen ...
6
votes
2answers
1k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
0
votes
2answers
38 views

DB Security from system admin perspective

I need some clarity in terms of Security involving Linux Admins and DBAs. Oracle DB on an Enterprise Linux server. I want to ensure none of the contractor team be able to tamper database and its ...
3
votes
2answers
51 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
3
votes
3answers
92 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
0
votes
0answers
28 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...
1
vote
4answers
952 views

Protect database data from everyone, including sys admins, etc

One of the things that has always bothered me about simple database data encryption: If the server is compromised, the database is effectively compromised. The attacker can use the same code as the ...
6
votes
2answers
171 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
16
votes
5answers
9k views

Would removing spaces in a string protect against SQL injection?

I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input? I have been reading up on SQL Injection at OWASP, but they don't mention ...
1
vote
1answer
27 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
0
votes
1answer
45 views

What more can I do to secure my service?

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to ...
0
votes
2answers
127 views

I want to encrypt certain entries in a database. Is this a good plan?

I'm working on a web app and want to offer the users the option to "encrypt" their account. This wouldn't encrypt everything related to them in the database. Just certain critical fields. I've ...
6
votes
4answers
109 views

How can releasing the text of an SQL query compromise security?

I have asked a government agency, under Freedom of Information legislation, to release two SQL queries they ran to produce a table which they published in a report. That is, the agency published ...
0
votes
1answer
42 views

Are there attacks to steal database records from memory in cloud?

Imagine a hosted database in public cloud. The database records are encrypted only on disk (data-at-rest). Are there are any attacks that steal the database records from the memory (when queries are ...
1
vote
1answer
40 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
2
votes
2answers
148 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
-3
votes
2answers
97 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
0
votes
0answers
41 views

Best way to store SQLite password offline? [duplicate]

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
-4
votes
1answer
87 views

Safest SQL database [closed]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
6
votes
4answers
386 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
3
votes
2answers
85 views

What are the best practices for trusting connection sources in open source software?

Quite concise, but I'll elaborate with an example: Lets say I have a simple app written in C# and i want to know how many people a day open the app. the easiest solution would be to simply have a ...
1
vote
1answer
97 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
4
votes
1answer
141 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
8
votes
3answers
968 views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
6
votes
0answers
49 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
0
votes
1answer
78 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
0
votes
1answer
146 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
3answers
52 views

Denial of Service by SQL queries - are selective queries better than queries that return a lot?

Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the ...
0
votes
3answers
92 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
-8
votes
4answers
170 views

Why shouldn't I store passwords in plaintext? [closed]

Why is it so important not to save passwords in plaintext? I think it is the same issue like authorizing a user on a RESTful webservice, where most developers claim: "Don't send your security token ...
2
votes
5answers
3k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
1
vote
0answers
25 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
2
votes
0answers
26 views

Is it a bad practice to not use a separate database server? [duplicate]

An isolated environment for just the application data sounds good, but does it have a significant security advantage compared to the everything-in-one-place model?
34
votes
4answers
5k views

Is using a DB prefix for tables more secure?

I see systems that use database prefixes. Some call it a security feature. Some call it a way to have multiple installations in one database. The main pro is that it's harder to guess the whole table ...
20
votes
6answers
12k views

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
-5
votes
1answer
153 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
3answers
93 views

How many backups should I keep?

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups. ...