MySQL is an open-source relational database management system.

learn more… | top users | synonyms

1
vote
2answers
172 views

Mysql database password and webform password

I have a Mysql database where one table is meant to store user complaints/comments/suggestions. I am using Mysqli to connect to the database with a ...
1
vote
1answer
47 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
1
vote
2answers
738 views

SQL Injection Issue Multi-line query

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as ...
1
vote
2answers
274 views

Overkill or appropriate?

I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server, and the database will be on its own ...
1
vote
1answer
152 views

System that manages real money

I am working on a project that incorporates real money into peoples accounts. Their accounts are stored in a MySQL database and inside it there is a column called "BALANCE". When the users send money ...
1
vote
2answers
820 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, ...
1
vote
4answers
1k views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
1
vote
1answer
486 views

MySQL encryption without knowing key

I am currently struggling with how to correctly implement storage of encrypted fields in a MySQL db, without knowing the encryption key. The result I am trying to achieve is to encrypt certain pieces ...
1
vote
1answer
94 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
1
vote
1answer
1k views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
1
vote
4answers
297 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
1
vote
1answer
302 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
2answers
816 views

How to implement shamir's secret sharing algorithm using AES_ENCYRPT

I am using MySQL AES_ENCRYTP() and AES_DECRYPT() to store sensitive details in a database, and currently storing the key in a php file outside of the web root with read access only. The key file looks ...
1
vote
1answer
100 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
1
vote
1answer
41 views

MySQL Full Text Search Safety

Is this code safe from sql injection? $search = $_GET ['search']; $query = $db->prepare("SELECT COUNT(*) AS num FROM table WHERE MATCH (id,keywords) AGAINST ('$search*' IN BOOLEAN MODE)"); ...
1
vote
1answer
132 views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
1
vote
1answer
646 views

How we can Update table via sqlmap?

How we can update a table via sqlmap ? The injection is like this : mysite.com/?menu=-8' UNION ALL SELECT ...
1
vote
1answer
68 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
1
vote
1answer
855 views

How can I securely delete items in a database?

I know that to securely delete files on a system I have to apply some kind of secure deletion (overwritting empty clusters, for example). But when I want to delete some information on a database ...
1
vote
1answer
123 views

What are the traces of a mysql attack on a server when the attacker has full permissions?

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
1
vote
1answer
187 views

How to use mySQL UNION operator in sql injection, with injectable password paramiter?

Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass ...
1
vote
1answer
245 views

If mysql schema is missing, where can I find credentials?

After finding a sql injection vulnerability I need to provide the more information I can about the DB. Minimum I need to provide a list of users and passwords. I identified that it's a MySQL but ...
1
vote
1answer
564 views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is ...
1
vote
1answer
538 views

SQL truncation vulnerability

I came to know the SQL truncation vulnerability that I wasn't aware of. It is my understanding that this vulnerability is based on the fact that MySQL truncates the value of an "insert query" whether ...
1
vote
1answer
385 views

how to null out a insert statement?

I am doing a SQLi-Quiz. Below is the orignal statement. insert into users(name,pass) values('bob', [injection point here]) The statement is heavily filterd because the website which supplys the ...
1
vote
1answer
140 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
1
vote
3answers
158 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
1
vote
2answers
470 views

What permissions should I give to a MySQL 'user' that searches my database?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
1
vote
1answer
154 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
1
vote
1answer
515 views

MySQL AES Encryption - Is it good idea to store 3rd Party Auth Tokens using AES Encryption?

I need some advice on MySQL AES Encryption. I'm developing an application which connects to various 3rd-Party APIs and retrieves the Access Tokens for the application users. These Access Tokens are ...
1
vote
4answers
604 views

Check for database tampering

I have a database table that I want to confirm has not been tinkered with. My theory is to create a hash of static items and store that in the table. Then compare these when the data is required, for ...
1
vote
1answer
37 views

SQLi with comment filter: dumping the database

The following SQLi (MySQL) filter is from SQLi-Labs: ... $reg = "/#/" $reg1 ="/--/" $replace ="" $id=preg_replace($reg,$replace,$id); $id=preg_replace($reg1,$replace,$id); .... $sql = "SELECT ...
1
vote
0answers
14 views

Create a non root user for MySQL with minimal right as using root is not secure [closed]

General rule for root MySQL user is from infosec point of view: "Do not use root for any web application for MySQL connection, Select, Update, or Delete queries. Instead of create and use another ...
1
vote
2answers
116 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
1
vote
0answers
74 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
1answer
196 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
0answers
49 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
104 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
383 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
0answers
442 views

MySQL Database Activity Monitoring Solutions [closed]

We are looking for a DAM solution for MySQL. There is of course GreenSQL but it seems to lack some of the features we desire like robust filtering of reports for export purposes, etc. It's very ...
0
votes
2answers
120 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
0
votes
1answer
68 views

how to get mysql user password? [closed]

I have a problem. I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. ...
0
votes
1answer
74 views

Should I block users from viewing SQL files?

I've been told it's wise to use .htaccess to block users from viewing .sql files etc. Looking for advice on this. If I block user access, will this affect my admin-side ability to write to sql? If so, ...
0
votes
4answers
3k views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
2answers
268 views

Is it necessary to use SSL for MySQL?

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet. VB.NET ...
0
votes
1answer
314 views

Is SQL Injection possible in this PHP registration script? [closed]

I've recently created a PHP registration script for a website that a friend and I are working on. I've read up on the dangers of MySQL injection, and I was wondering if my current code is protected ...
0
votes
3answers
97 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
1answer
76 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
0
votes
1answer
79 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
1answer
197 views

Securing SQL injection for my PHP files [closed]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...