MySQL is an open-source relational database management system.

learn more… | top users | synonyms

1
vote
1answer
114 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
0answers
42 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
75 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
236 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
0answers
343 views

MySQL Database Activity Monitoring Solutions [closed]

We are looking for a DAM solution for MySQL. There is of course GreenSQL but it seems to lack some of the features we desire like robust filtering of reports for export purposes, etc. It's very ...
0
votes
1answer
55 views

how to get mysql user password? [closed]

I have a problem. I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. ...
0
votes
4answers
359 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
2answers
62 views

Is it necessary to use SSL for MySQL?

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet. VB.NET ...
0
votes
1answer
191 views

Is SQL Injection possible in this PHP registration script? [closed]

I've recently created a PHP registration script for a website that a friend and I are working on. I've read up on the dangers of MySQL injection, and I was wondering if my current code is protected ...
0
votes
3answers
92 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
1answer
221 views

SQL injection on query (MySQL/PHP) [closed]

First, sorry if my issue is a duplicate! This is an exercise that I can not solve. It is an authentication, simply. But the problem is that the application does not check both the password and ...
0
votes
2answers
74 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...
0
votes
2answers
2k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
0
votes
2answers
148 views

Security on Ubuntu 12.04 LST Server for Business App

I am developing bussines application based on php and mysql on ubuntu 12.04 lts server. I have closed all ports except :80 and php code can be executed only by security login and not using cookies but ...
0
votes
2answers
154 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
0
votes
3answers
673 views

Is there such a thing as MySQL connection flooding?

I'm a developer for a small website. There are 3 webservers (for load balancing) and a MySQL server. Today the webservers seem to be down, and, unfortunately, I cannot get hold of the admin (he's in ...
0
votes
1answer
60 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
0
votes
1answer
818 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
1answer
382 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
0
votes
1answer
488 views

Is it secure to use a custom written Php extension for handling + hashing (db) keys?

I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
0
votes
1answer
198 views

Facebook data visibility to admin staff

I recently had a conversation with a friend in which I told him that everything written on Facebook can be seen by the Facebook admin staff. As a software engineer and database administrator I know ...
0
votes
1answer
42 views

System backup in case of attack?

My system will be running for a well known insurance company within the UK, it will hold and process a lot of information for claims, brakdowns etc etc. I am worried that the company and the site as ...
0
votes
1answer
51 views

Injecting a query within a query that has an order by or group by function [closed]

Select * from Shop where Item = $item order by ProductNum desc I found this vulnerability within a website. To test if there's any vulnerabilities I inserted a single quotation after ...
0
votes
1answer
1k views

sqlmap - Dump multiple columns at once? [closed]

I'm playing around with sqlmap, and I'm having a little trouble dumping database columns. I can dump all of them at once which is great, but this database has thousands of users and dumping every ...
0
votes
1answer
1k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
0
votes
1answer
208 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
0
votes
1answer
1k views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
0
votes
1answer
241 views

A Question about Database Encryption [closed]

I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this. How can one improve the security in a MySQL database? The database that ...
0
votes
3answers
2k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
3answers
884 views

Connect to Mysql database from remote host without remote access [closed]

I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled. I know that many people have some of my ...
0
votes
0answers
32 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
0answers
111 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
333 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
165 views

HIPAA requirements for local server

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement. Most computers will most likely have no ...
0
votes
0answers
786 views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
0
votes
1answer
153 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
0
votes
2answers
248 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
-1
votes
2answers
64 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
-1
votes
1answer
3k views

How to hack linux from phpMyAdmin? [closed]

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the ...
-1
votes
1answer
155 views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
-1
votes
2answers
3k views

Issues setting up DVWA for SQLMAP [closed]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
-1
votes
0answers
24 views

php doesn´t interpret my hex characters as hex [migrated]

I am trying to understand a mysql injection not working as expected. I have a php script that does a login based on username and password supplied on a webpage. The query string looks like this: ...
-1
votes
1answer
73 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
-2
votes
2answers
156 views

How to know table name, and column names for login panel

I want to know the table name and column names of that table in website login page. How should I do that. There are only two input fields, Username and Password. And it is vulnerable to Sql ...
-2
votes
2answers
981 views

Is this site vulnerable to sql injection? [closed]

I have my site build from a company. I read about website vulnerabilities on the internet and i did some test on my site. It throws these errors. QueryString key:TutorialId was expected to be of ...
-2
votes
2answers
116 views

LAMP Stack Tiers - why?

What are the vulnerabilities mitigated by a tiered LAMP stack? As I understand it, any breach would allow access to the database even if it was tiered. What's the benefit? Are we better to ...
-2
votes
1answer
184 views

Using Old version of mysql connector's security issue [closed]

I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
-2
votes
1answer
689 views

Admin area in my php website is vulnerable to sql injection without login [closed]

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. ...
-4
votes
1answer
150 views

How to make my PHP website vulnerable to SQL injection [duplicate]

For training purposes, I want to make a demo website vulnerable to SQL injection. I went to the .htaccess file in the server and added these 2 lines: php_flag magic_quotes_gpc Off php_flag ...